Googlers see b/74022057 for additional context. Most of the details of this bug are public, however, and I'll try to explain everything on this bug.

If a renderer on url A is killed right when a load of url B occurs in the same renderer, the reload of page A can happen after the load of B starts, causing the renderer to end up on url A instead of the expected B.

This bug was discovered in the context of custom tabs. If a background (speculation) renderer to a url A is started, commits, and then is killed at the same time that a load to a new url B that matches A, the now-killed speculative renderer will be used for the load of B. It can happen that the reload scheduled after the kill by TabWebContentsObserver.renderProcessGone will occur after the load to url B starts, replacing that pending load and causing the background tab to display url A instead of the expected B.

See also CustomTabsConnection.launchUrlInHiddenTab and takeHiddenTab for additional context.

A fix for this seems to be for didStartPageLoad to unset mNeedsReload. As all the relevant Tab methods are run on the UI thread, this is enough to break the race.