Fix a crash in ProfileDestroyer due to delayed RenderProcessHost destruction

This CL addresses a crash (CHECK_EQ being hit) on desktop when a
RenderProcessHost instance is still alive while the associated
ProfileDestroyer is on its way to destruction. This started happening
after https://crrev.com/c/1971031 landed to fix other crash on Android
by delaying the destruction the off-the-record profile, which would
have destroyed the RPH before hitting the CHECK_EQ.

This CL moves the off-the-record profile destruction task where it was
but uses |DestroyOffTheRecordProfileNow| instead. This change takes
care of the desktop crash but also makes sure the clean up task
required for the Android issue comes before the profile destruction.

Bug: 1040839
Change-Id: Iabab0a304a802d1bd64adec255e88d81b6987cde
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2032385
Commit-Queue: Jinsuk Kim <jinsukkim@chromium.org>
Reviewed-by: Mihai Sardarescu <msarda@chromium.org>
Cr-Commit-Position: refs/heads/master@{#738746}

chrome/browser/profiles/profile_destroyer.cc

@@ -161,23 +161,24 @@ ProfileDestroyer::ProfileDestroyer(Profile* const profile, HostSet* hosts)
 }
 
 ProfileDestroyer::~ProfileDestroyer() {
-  // Don't wait for pending registrations, if any, these hosts are buggy.
-  // Note: this can happen, but if so, it's better to crash here than wait
-  // for the host to dereference a deleted Profile. http://crbug.com/248625
+  if (profile_) {
+    ProfileDestroyer::DestroyOffTheRecordProfileNow(profile_);
+    profile_ = nullptr;
+  }
+
+  // Once the profile is deleted, all renderer hosts must have been deleted.
+  // Crash here if this is not the case instead of having a host dereference
+  // a deleted profile. http://crbug.com/248625
   CHECK_EQ(0U, num_hosts_) << "Some render process hosts were not "
                            << "destroyed early enough!";
-  DCHECK(pending_destroyers_ != NULL);
+
+  DCHECK(pending_destroyers_ != nullptr);
   auto iter = pending_destroyers_->find(this);
   DCHECK(iter != pending_destroyers_->end());
   pending_destroyers_->erase(iter);
   if (pending_destroyers_->empty()) {
     delete pending_destroyers_;
-    pending_destroyers_ = NULL;
-  }
-
-  if (profile_) {
-    ProfileDestroyer::DestroyOffTheRecordProfileNow(profile_);
-    profile_ = nullptr;
+    pending_destroyers_ = nullptr;
   }
 }