Explicitly ShutdownOnUIThread the HostContentSettingsMap when destroying the Profile.

chrome/browser/profiles/profile.cc

Index: chrome/browser/profiles/profile.cc
diff --git a/chrome/browser/profiles/profile.cc b/chrome/browser/profiles/profile.cc
index b5f9a32fbdd4dbd62879b47b97693ee77ad59e7a..0e3bb1e8730088f66f2bb7d0c10e0a11060fa7bf 100644
--- a/chrome/browser/profiles/profile.cc
+++ b/chrome/browser/profiles/profile.cc
@@ -516,8 +516,10 @@ class OffTheRecordProfileImpl : public Profile,
     // Retrieve the host content settings map of the parent profile in order to
     // ensure the preferences have been migrated.
     profile_->GetHostContentSettingsMap();
-    if (!host_content_settings_map_.get())
-      host_content_settings_map_ = new HostContentSettingsMap(this);
+    if (!host_content_settings_map_.get()) {
+      host_content_settings_map_ = new HostContentSettingsMap(
+          GetPrefs(), GetExtensionService(), true);
+    }
     return host_content_settings_map_.get();
   }