Minimal repro for v8::HeapProfiler crash

content_shell.patch

diff --git a/content/shell/renderer/shell_render_frame_observer.cc b/content/shell/renderer/shell_render_frame_observer.cc
index ed6134a67e3e..dc6de8323542 100644
--- a/content/shell/renderer/shell_render_frame_observer.cc
+++ b/content/shell/renderer/shell_render_frame_observer.cc
@@ -8,7 +8,9 @@
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "content/shell/common/shell_switches.h"
+#include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_testing_support.h"
+#include "v8/include/v8-profiler.h"
 
 namespace content {
 
@@ -25,6 +27,11 @@ void ShellRenderFrameObserver::DidClearWindowObject() {
   }
 }
 
+void ShellRenderFrameObserver::DidFinishDocumentLoad() {
+  auto* snapshot = blink::MainThreadIsolate()->GetHeapProfiler()->TakeHeapSnapshot();
+  DCHECK(snapshot != nullptr);
+}
+
 void ShellRenderFrameObserver::OnDestruct() {
   delete this;
 }
diff --git a/content/shell/renderer/shell_render_frame_observer.h b/content/shell/renderer/shell_render_frame_observer.h
index 2f40722cf4bc..20dc59dc391a 100644
--- a/content/shell/renderer/shell_render_frame_observer.h
+++ b/content/shell/renderer/shell_render_frame_observer.h
@@ -21,6 +21,7 @@ class ShellRenderFrameObserver : public RenderFrameObserver {
   // RenderFrameObserver implementation.
   void DidClearWindowObject() override;
   void OnDestruct() override;
+  void DidFinishDocumentLoad() override;
 };
 
 }  // namespace content