Ensure that MetricsServicesManager is destroyed before local_state PrefService

MetricsServicesManager holds a pointer to local_state, so it should be
destroyed before local_state is. Reorder the member variables
accordingly.
This is usually not an issue because BrowserProcessImpl::StartTearDown
ensures this. However, if BrowserProcessImpl::~BrowserProcessImpl() runs
without StartTearDown having been called, the order of the member
variables matters.

Bug: 1064429
Test: See clusterfuzz reproduction line in https://crbug.com/1064429
Change-Id: I98c64efcd52be77a0df944b1a9ee1958000946af
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2119516
Commit-Queue: Pavol Marko <pmarko@chromium.org>
Reviewed-by: Colin Blundell <blundell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#754569}

chrome/browser/browser_process_impl.h

@@ -235,13 +235,6 @@ class BrowserProcessImpl : public BrowserProcess,
   void Pin();
   void Unpin();
 
-  // |metrics_services_manager_| owns this.
-  ChromeMetricsServicesManagerClient* metrics_services_manager_client_ =
-      nullptr;
-
-  std::unique_ptr<metrics_services_manager::MetricsServicesManager>
-      metrics_services_manager_;
-
   bool created_watchdog_thread_ = false;
   std::unique_ptr<WatchDogThread> watchdog_thread_;
 
@@ -255,6 +248,14 @@ class BrowserProcessImpl : public BrowserProcess,
 
   std::unique_ptr<PrefService> local_state_;
 
+  // |metrics_services_manager_| owns this.
+  ChromeMetricsServicesManagerClient* metrics_services_manager_client_ =
+      nullptr;
+
+  // Must be destroyed before |local_state_|.
+  std::unique_ptr<metrics_services_manager::MetricsServicesManager>
+      metrics_services_manager_;
+
   std::unique_ptr<network::NetworkQualityTracker> network_quality_tracker_;
 
   // Listens to NetworkQualityTracker and sends network quality updates to the