Fix destruction order in WebUIImpl for BackupRefPtr

When BackupRefPtr is used for WebUIImpl::web_contents_, the destruction order of the fields causes a null dereference.
This is because BackupRefPtr is cleared in the destructor.
The destructor of WebUIMessageHandler subclasses are accessing the WebContentsImpl through WebUIImpl::web_contents_.

Bug: 1080832
Change-Id: I24570aad42dbd09febd94ef6d25be31c9817c091
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2564979Reviewed-by: Tommy Li <tommycli@chromium.org>
Reviewed-by: Bartek Nowierski <bartekn@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Keishi Hattori <keishi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#834108}

content/browser/webui/web_ui_impl.h

@@ -121,15 +121,15 @@ class CONTENT_EXPORT WebUIImpl : public WebUI,
   // The URL schemes that can be requested by this document.
   std::vector<std::string> requestable_schemes_;
 
-  // The WebUIMessageHandlers we own.
-  std::vector<std::unique_ptr<WebUIMessageHandler>> handlers_;
-
   // RenderFrameHost associated with |this|.
   RenderFrameHost* frame_host_;
 
   // Non-owning pointer to the WebContentsImpl this WebUI is associated with.
   WebContentsImpl* web_contents_;
 
+  // The WebUIMessageHandlers we own.
+  std::vector<std::unique_ptr<WebUIMessageHandler>> handlers_;
+
   // Notifies this WebUI about notifications in the main frame.
   std::unique_ptr<WebUIMainFrameObserver> web_contents_observer_;