Fix GpuChannelHost destruction races.

content/browser/browser_main_loop.cc

Index: content/browser/browser_main_loop.cc
diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc
index e7faa9ef0089bfadd1e5ebf9edd41cfa95ec8132..87059036956215f2f7f6960fa3f4a5b54748668d 100644
--- a/content/browser/browser_main_loop.cc
+++ b/content/browser/browser_main_loop.cc
@@ -513,7 +513,6 @@ void BrowserMainLoop::ShutdownThreadsAndCleanUp() {
 #if defined(USE_AURA)
   ImageTransportFactory::Terminate();
 #endif
-  BrowserGpuChannelHostFactory::Terminate();
 
   // The device monitors are using |system_monitor_| as dependency, so delete
   // them before |system_monitor_| goes away.
@@ -618,6 +617,10 @@ void BrowserMainLoop::ShutdownThreadsAndCleanUp() {
   BrowserThreadImpl::ShutdownThreadPool();
 
 #if !defined(OS_IOS)
+  // Must happen after the IO thread is shutdown since this may be accessed from
+  // it.
+  BrowserGpuChannelHostFactory::Terminate();
+
   // Must happen after the I/O thread is shutdown since this class lives on the
   // I/O thread and isn't threadsafe.
   GamepadService::GetInstance()->Terminate();