Fix destruction order of PromoResourceService and NTPResourceCache

The existing code was leading to a crash:
- NTPResourceCache has a callback subscription on PromoResourceService
- PromoResourceService was deleted before NTPResourceCache
- When the NTPResourceCache was destroyed, it tried to remove itself
  from the callback list, which no longer exists and crashes.

The bug was introduced by
https://codereview.chromium.org/926633002

This CL changes the destruction order so that the PromoResourceService
is deleted after NTPResourceCache (which is a keyed service and thus is
tied to the profile).

BUG=464391

Review URL: https://codereview.chromium.org/988433002

Cr-Commit-Position: refs/heads/master@{#319491}

1 files changed, 4 insertions, 1 deletions

diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_process_impl.cc
index 0f7eecd..7b65c6d 100644
--- a/chrome/browser/browser_process_impl.cc
+++ b/chrome/browser/browser_process_impl.cc
@@ -245,7 +245,6 @@ void BrowserProcessImpl::StartTearDown() {
   if (safe_browsing_service_.get())
     safe_browsing_service()->ShutDown();
 #endif
-  promo_resource_service_.reset();
 #if defined(ENABLE_PLUGIN_INSTALLATION)
   plugins_resource_service_.reset();
 #endif
@@ -270,6 +269,10 @@ void BrowserProcessImpl::StartTearDown() {
     profile_manager_.reset();
   }
 
+  // PromoResourceService must be destroyed after the keyed services and before
+  // the IO thread.
+  promo_resource_service_.reset();
+
 #if !defined(OS_ANDROID)
   // Debugger must be cleaned up before IO thread and NotificationService.
   remote_debugging_server_.reset();