The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bac34b4382ce71d0949f3228992a87c37366d95d

commit bac34b4382ce71d0949f3228992a87c37366d95d
Author: Tobias Sargeant <tobiasjs@google.com>
Date: Mon Nov 12 22:00:11 2018

[aw] Fix a race associated with terminating a WebView renderer.

Race condition is caused by RenderProcessHost::Shutdown recreating the
sync IPC channel and asynchronously causing SyncContext::OnChannelOpened
to be called on the IO thread.

In the interim the RPH has been deleted, causing the WaitableEvent that
was passed to the SyncContext to be destroyed before it is used.

Because we never intend to use the WaitableEvent to signal shutdown in
WebView, it's simplest to just pass null for the shutdown_event,
indicating that the caller never intends to signal shutdown.

Bug:  904043 ,865062
Change-Id: I69a51adc78a0f1c0d6f84fbb7206fc9d58e69ed2
Reviewed-on: https://chromium-review.googlesource.com/c/1329670
Commit-Queue: Tobias Sargeant <tobiasjs@chromium.org>
Reviewed-by: Ken Rockot <rockot@google.com>
Reviewed-by: Bo <boliu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#607343}
[modify] https://crrev.com/bac34b4382ce71d0949f3228992a87c37366d95d/content/browser/renderer_host/render_process_host_impl.cc
[modify] https://crrev.com/bac34b4382ce71d0949f3228992a87c37366d95d/content/browser/renderer_host/render_process_host_impl.h
[modify] https://crrev.com/bac34b4382ce71d0949f3228992a87c37366d95d/ipc/ipc_sync_channel.cc

This is fixed in 72.0.3609.0 and can be verified once that rolls to the support library.