Fix a data race in WebMessagePortChannelImpl.

content/child/webmessageportchannel_impl.cc

Index: content/child/webmessageportchannel_impl.cc
diff --git a/content/child/webmessageportchannel_impl.cc b/content/child/webmessageportchannel_impl.cc
index b2ef7e411b2a674aa64fdaf6a16f2e5e94cab345..2b4d265a895c981473ee0968e714490b6d43f3e1 100644
--- a/content/child/webmessageportchannel_impl.cc
+++ b/content/child/webmessageportchannel_impl.cc
@@ -168,9 +168,13 @@ void WebMessagePortChannelImpl::postMessage(
     WebMessagePortChannelArray* channels_ptr) {
   std::unique_ptr<WebMessagePortChannelArray> channels(channels_ptr);
   if (!main_thread_task_runner_->BelongsToCurrentThread()) {
+    // Note: we must construct the base::string16 here and pass that. Otherwise,
+    // the WebString will be passed, leading to references to the StringImpl
+    // from two threads, which is a data race.
     main_thread_task_runner_->PostTask(
         FROM_HERE, base::Bind(&WebMessagePortChannelImpl::SendPostMessage, this,
-                              message, base::Passed(std::move(channels))));
+                              base::Passed(base::string16(message)),
+                              base::Passed(std::move(channels))));
   } else {
     SendPostMessage(message, std::move(channels));
   }