UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

Example URL:

Steps to reproduce the problem:
1. create local file a.html with content like this:
<a href="http://google.com" target="_blank" >Google</a>
2. content_shell.exe --no-sandbox a.html
3. click link -> new window opens
4. close the new window when it is loaded completely (scroll handlers installed)
5. assertion failure with stack below

if started with sandbox
2a. content_shell.exe a.html
5a. new window closes but parent window is no longer functional

What is the expected behavior?

What went wrong?
>	base.dll!base::debug::BreakDebugger() Line 21	C++
 	base.dll!logging::LogMessage::~LogMessage() Line 868	C++
 	blink_core.dll!blink::ChromeClientImpl::SetHasScrollEventHandlers(blink::LocalFrame * frame, bool has_event_handlers) Line 983	C++
 	blink_core.dll!blink::EventHandlerRegistry::NotifyHasHandlersChanged(blink::EventTarget * target, blink::EventHandlerRegistry::EventHandlerClass handler_class, bool has_active_handlers) Line 249	C++
 	blink_core.dll!blink::EventHandlerRegistry::UpdateEventHandlerInternal(blink::EventHandlerRegistry::ChangeOperation op, blink::EventHandlerRegistry::EventHandlerClass handler_class, blink::EventTarget * target) Line 143	C++
 	blink_core.dll!blink::EventHandlerRegistry::UpdateEventHandlerOfType(blink::EventHandlerRegistry::ChangeOperation op, const WTF::AtomicString & event_type, const blink::AddEventListenerOptions & options, blink::EventTarget * target) Line 159	C++
 	blink_core.dll!blink::EventHandlerRegistry::DidRemoveEventHandler(blink::EventTarget & target, const WTF::AtomicString & event_type, const blink::AddEventListenerOptions & options) Line 174	C++
 	blink_core.dll!blink::LocalDOMWindow::RemovedEventListener(const WTF::AtomicString & event_type, const blink::RegisteredEventListener & registered_listener) Line 1416	C++
 	blink_core.dll!blink::EventTarget::RemoveEventListenerInternal(const WTF::AtomicString & event_type, const blink::EventListener * listener, const blink::EventListenerOptions & options) Line 501	C++
 	blink_core.dll!blink::EventTarget::removeEventListener(const WTF::AtomicString & event_type, const blink::EventListener * listener, bool use_capture) Line 439	C++
 	blink_core.dll!blink::EventTarget::removeEventListener(const WTF::AtomicString & event_type, const blink::EventListener * listener, const blink::EventListenerOptionsOrBoolean & options_union) Line 446	C++
 	blink_core.dll!blink::EventTargetV8Internal::removeEventListenerMethod(const v8::FunctionCallbackInfo<v8::Value> & info) Line 153	C++
 	blink_core.dll!blink::V8EventTarget::removeEventListenerMethodCallback(const v8::FunctionCallbackInfo<v8::Value> & info) Line 204	C++
 	v8.dll!v8::internal::FunctionCallbackArguments::Call(v8::internal::CallHandlerInfo * handler) Line 120	C++
 	v8.dll!v8::internal::`anonymous namespace'::HandleApiCallHelper<0>(v8::internal::Isolate * isolate, v8::internal::Handle<v8::internal::HeapObject> function, v8::internal::Handle<v8::internal::HeapObject> new_target, v8::internal::Handle<v8::internal::FunctionTemplateInfo> fun_data, v8::internal::Handle<v8::internal::Object> receiver, v8::internal::BuiltinArguments args) Line 111	C++
 	v8.dll!v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments args, v8::internal::Isolate * isolate) Line 139	C++
 	v8.dll!v8::internal::Builtin_HandleApiCall(int args_length, v8::internal::Object * * args_object, v8::internal::Isolate * isolate) Line 127	C++
 	[External Code]	

Does it occur on multiple sites: N/A

Is it a problem with a plugin? N/A 

Did this work before? Yes commit 69a682b4f38b203b1333c046a65e8dbe7fa375c9

Does this work in other browsers? N/A

Chrome version: 68.0.3440.106  Channel: dev
OS Version: 10.0
Flash Version: 

git revert 662d53892dd39ea48f32a2214e6967db3a516965 
probably fixes the issue but doesn't solve it.