Pending tasks in a message loop should be deleted before shutting down Blink

content/renderer/render_thread_impl.cc

Index: content/renderer/render_thread_impl.cc
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index 3842bca15684605283d42e4376996aeb1eb0c7fa..af1f3e92d22a8c6ceda654a2e30ea620fb986eac 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -652,8 +652,13 @@ void RenderThreadImpl::Shutdown() {
 
   main_thread_compositor_task_runner_ = NULL;
 
-  if (webkit_platform_support_)
+  if (webkit_platform_support_) {
+    // It's possible that the message loop has a pending task that can touch
+    // Blink objects. To prevent the task from running after Blink shuts down,
+    // we flush all the pending tasks here.
+    message_loop()->FlushPendingTasks();
     blink::shutdown();
+  }
 
   lazy_tls.Pointer()->Set(NULL);