Pending tasks in a message loop should be deleted before shutting down Blink

content/renderer/render_thread_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_thread_impl.h"
 
 #include <algorithm>
 #include <limits>
 #include <map>
 #include <vector>
@@ skipping 634 matching lines @@
   // EmbeddedWorkerDispatcher. So it must be deleted before deleting
   // RenderThreadImpl.
   embedded_worker_dispatcher_.reset();
 
   // Ramp down IDB before we ramp down WebKit (and V8), since IDB classes might
   // hold pointers to V8 objects (e.g., via pending requests).
   main_thread_indexed_db_dispatcher_.reset();
 
   main_thread_compositor_task_runner_ = NULL;
 
-  if (webkit_platform_support_)
+  if (webkit_platform_support_) {
+    // It's possible that the message loop has a pending task that can touch
+    // Blink objects. To prevent the task from running after Blink shuts down,
+    // we flush all the pending tasks here.
+    message_loop()->FlushPendingTasks();
     blink::shutdown();
+  }
 
   lazy_tls.Pointer()->Set(NULL);
 
   // TODO(port)
 #if defined(OS_WIN)
   // Clean up plugin channels before this thread goes away.
   NPChannelBase::CleanupChannels();
 #endif
 }
 
@@ skipping 985 matching lines @@
   hidden_widget_count_--;
 
   if (!GetContentClient()->renderer()->RunIdleHandlerWhenWidgetsHidden()) {
     return;
   }
 
   ScheduleIdleHandler(kLongIdleHandlerDelayMs);
 }
 
 }  // namespace content