RouterStageMerge::kill() retrieves an Event which will be signaled when the mongos cursor is safe to destroy. However, this Event will be invalid if it is retrieved while mongos is shutting down, as documented here:

https://github.com/mongodb/mongo/blob/r3.5.1/src/mongo/s/query/async_results_merger.h#L170

This case is not handled correctly by RouterStageMerge::kill(), since it can wait on an invalid event, resulting in an invariant being triggered. Fixing RouterStageMerge::kill() to not wait on an invalid event is a partial fix for SERVER-25497, which describes the more general problem of the mongos query path not being synchronized with the process's shutdown sequence.