The send done event in the old send watcher can be NULL as it can be signaled...

ipc/ipc_sync_channel.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ipc/ipc_sync_channel.h"
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/thread_local.h"
 #include "base/message_loop.h"
@@ skipping 450 matching lines @@
   sync_msg_queue->set_top_send_done_watcher(&send_done_watcher);
 
   send_done_watcher.StartWatching(sync_context()->GetSendDoneEvent(), this);
   bool old_state = MessageLoop::current()->NestableTasksAllowed();
 
   MessageLoop::current()->SetNestableTasksAllowed(true);
   MessageLoop::current()->Run();
   MessageLoop::current()->SetNestableTasksAllowed(old_state);
 
   sync_msg_queue->set_top_send_done_watcher(old_send_done_event_watcher);
-  if (old_send_done_event_watcher) {
+  if (old_send_done_event_watcher && old_event) {
     old_send_done_event_watcher->StartWatching(old_event, old_delegate);
   }
 }
 
 void SyncChannel::OnWaitableEventSignaled(WaitableEvent* event) {
   WaitableEvent* dispatch_event = sync_context()->GetDispatchEvent();
   if (event == dispatch_event) {
     // The call to DispatchMessages might delete this object, so reregister
     // the object watcher first.
     dispatch_event->Reset();
     dispatch_watcher_.StartWatching(dispatch_event, this);
     sync_context()->DispatchMessages();
   } else {
     // We got the reply, timed out or the process shutdown.
     DCHECK(event == sync_context()->GetSendDoneEvent());
     MessageLoop::current()->Quit();
   }
 }
 
 }  // namespace IPC