Make sure that the global NetworkServiceClient gets released at shutdown

This NetworkServiceClient owns a MemoryPressureListener and it's
necessary to ensure that this listener gets destructed at shutdown to
avoid UAFs in tests (see crbug.com/1081151).

Bug: 1081151
Change-Id: Ia72a4fd35e17effe00f71018f032f2bd62118182
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2293162Reviewed-by: Matt Menke <mmenke@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Sébastien Marchand <sebmarchand@chromium.org>
Cr-Commit-Position: refs/heads/master@{#789946}

content/browser/network_service_instance_impl.cc

@@ -233,12 +233,13 @@ net::NetLogCaptureMode GetNetCaptureModeFromCommandLine(
   return net::NetLogCaptureMode::kDefault;
 }
 
+static NetworkServiceClient* g_client = nullptr;
+
 }  // namespace
 
 network::mojom::NetworkService* GetNetworkService() {
   if (!g_network_service_remote)
     g_network_service_remote = new mojo::Remote<network::mojom::NetworkService>;
-  static NetworkServiceClient* g_client;
   if (!g_network_service_remote->is_bound() ||
       !g_network_service_remote->is_connected()) {
     bool service_was_bound = g_network_service_remote->is_bound();
@@ -445,6 +446,8 @@ void ResetNetworkServiceForTesting() {
 void ShutDownNetworkService() {
   delete g_network_service_remote;
   g_network_service_remote = nullptr;
+  delete g_client;
+  g_client = nullptr;
   if (g_in_process_instance) {
     GetNetworkTaskRunner()->DeleteSoon(FROM_HERE, g_in_process_instance);
     g_in_process_instance = nullptr;