braveyao@: Would you happen to have time to take a look at this?

Does the 'virtual machine that has camera emulation' mean an Android emulator?
I can't see such a problem with real device with Chromium debug building, e.g. I can still get camera capture in Chromium after switching Apps back and forth. Is that same at your side?
In the history, Android emulator is not good enough for any media testing. So I never use it for WebRTC. And doubt if it's a real issue.

Sorry for the confusion. Yes I meant an Android emulator. I now updated the description above to make it more clear.

Looks like the issue does not reproduce 100%. I only ran into it on the first try and didn't check if it is consistent. It may not be, but it is definitely a real issue. This DCHECK should never get hit, regardless of whether or not we run on an emulator or real device.

The run-time environment may be not totally same between emulator and real device. So it may not be a real issue on real device. But it's true that the DCHECK should never get hit. It looks most probably the design here is not thread safe. 
Since this part of codes is not Android specific, this problem may be a general issue for all platforms. Sorry I'm not the right person. It's better to get the real expert on this.

Just ran into this crash on a real device, a Nexus 6p, while testing in the context of https://bugs.chromium.org/p/chromium/issues/detail?id=793859.

The test involved an unreleased web app that uses the camera for video and photo functionality. I switched back between video and photo modes, and after a couple of times it crashed on me. Logcat showed this 

12-18 16:18:51.627  3321  3321 F DEBUG   : Abort message: '[FATAL:video_capture_impl.cc(345)] Check failed: !cb_iter->second.get() || cb_iter->second->HasOneRef(). Instructed to delete buffer we are still using.

There is also a stack trace, which I still have to resolve. Will post it here when I get it.

The stack trace does not give much more information.
A call to OnBufferDestroyed() comes in via Mojo from the VideoCaptureHost at 
https://cs.chromium.org/chromium/src/content/browser/renderer_host/media/video_capture_host.cc?dr&l=145

I was able to reproduce this using the following steps:

1. Navigate to https://webrtc.github.io/samples/src/content/devices/input-output/ 
2. Observe that video capture is working
3. Use the video input selector to switch between front/back camera
4. Tap the Android app switcher button, which will lead to Chromium to be backgrounded
5. Tap the Chromium window to bring it back to the foreground
6. Repeat at step 3
=> Eventually, after step 4, the DCHECK at video_capture_impl.cc(345) will get hit and Chromium will crash

This may take some repeats before it happens. First time I tried it happens after 2 iterations. The second time it took about 20 iterations, so not very easy to repro at the moment.