Fix a null pointer for layer_tree_host on ScheduleAnimation callback.

Calling WebWidget::Close could end up calling ScheduleAnimation
back but layer_tree_host_ would be null.

Destroying the WidgetBase (which owns the LayerTreeHost) is the last
thing that WebWidget::Close does so it is safe to move the assignment
after the close.

The long term fix here is to remove the layer_tree_host_ pointer from
RenderWidget entirely but those patches are yet complete.

BUG=1072927

Change-Id: I9d49f7c0f47c69bb8c5e300235bf355ae2cfec1f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2159745Reviewed-by: Avi Drissman <avi@chromium.org>
Reviewed-by: danakj <danakj@chromium.org>
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Cr-Commit-Position: refs/heads/master@{#761165}

content/renderer/render_widget.cc

@@ -1730,10 +1730,6 @@ void RenderWidget::Close(std::unique_ptr<RenderWidget> widget) {
   // is being destroyed.
   input_event_queue_->ClearClient();
 
-  // |layer_tree_host_| is valid only when |webwidget_| is valid, so
-  // clear it before calling Close.
-  layer_tree_host_ = nullptr;
-
   // The |widget_input_handler_manager_| needs to outlive the LayerTreeHost,
   // which is destroyed asynchronously by Close(). We pass ownership of it to
   // Close() for it to destroy the LayerTreeHost and
@@ -1744,6 +1740,11 @@ void RenderWidget::Close(std::unique_ptr<RenderWidget> widget) {
                      std::move(widget_input_handler_manager_)));
   webwidget_ = nullptr;
 
+  // |layer_tree_host_| is valid only when |webwidget_| is valid. Close may
+  // use the WebWidgetClient while unloading the Frame so we clear this
+  // after.
+  layer_tree_host_ = nullptr;
+
   // Note the ACK is a control message going to the RenderProcessHost.
   RenderThread::Get()->Send(new WidgetHostMsg_Close_ACK(routing_id()));
 }