Fix move order issue with NavigateParams::browser for BackupRefPtr

When Navigate() calls ShowSingletonTabOverwritingNTP(), the std::move(*params) is executed before params->browser is passed as an argument.
This becomes a problem when we use BackupRefPtr for NavigateParams::browser. Because BackupRefPtr will clear when moved so ShowSingletonTabOverwritingNTP will receive a nullptr.

Bug: 1080832
Change-Id: Id26f41e128b9c79d2506ac82e3655d1fdb58f1b8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567279Reviewed-by: Bartek Nowierski <bartekn@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Commit-Queue: Keishi Hattori <keishi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#834109}

chrome/browser/ui/browser_navigator.cc

@@ -538,7 +538,10 @@ void Navigate(NavigateParams* params) {
     // preserve. Fallback to the behavior used for singletons: overwrite the
     // current tab if it's the NTP, otherwise open a new tab.
     params->disposition = WindowOpenDisposition::SINGLETON_TAB;
-    ShowSingletonTabOverwritingNTP(params->browser, std::move(*params));
+    // Copy to a local variable first to avoid std::move from clearing
+    // |params->browser|.
+    Browser* browser = params->browser;
+    ShowSingletonTabOverwritingNTP(browser, std::move(*params));
     return;
   }
 #if BUILDFLAG(IS_CHROMEOS_ASH)