Fix declaration order of IOThreadHostImpl in RenderProcessHostImpl.

This CL fixes a mistake introduced in crrev.com/c/2005291.  That
previous change was trying to ensure that the IOThreadHostImpl was
destroyed before other members, but accidentally got it reversed.  C++
members are destroyed in reverse order so the IOThreadHostImpl member
should be declared at the end of the class similar to the
WeakPtrFactory.

Bug: 1038019
Change-Id: I66e1ee2e6fc4b02399d82af16cff33f118af671c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2019504Reviewed-by: Nasko Oskov <nasko@chromium.org>
Commit-Queue: Ben Kelly <wanderview@chromium.org>
Cr-Commit-Position: refs/heads/master@{#735296}

content/browser/renderer_host/render_process_host_impl.h

@@ -902,18 +902,6 @@ class CONTENT_EXPORT RenderProcessHostImpl
   // if the request isn't handled on the IO thread.
   void OnBindHostReceiver(mojo::GenericPendingReceiver receiver);
 
-  // IOThreadHostImpl owns some IO-thread state associated with this
-  // RenderProcessHostImpl. This is mainly to allow various IPCs from the
-  // renderer to be handled on the IO thread without a hop to the UI thread.
-  //
-  // Declare this early to ensure it triggers the destruction of the
-  // IOThreadHostImpl prior to other objects with an IO thread deleter.  This
-  // is necessary to ensure those objects stop receiving mojo messages before
-  // their destruction.
-  class IOThreadHostImpl;
-  friend class IOThreadHostImpl;
-  base::Optional<base::SequenceBound<IOThreadHostImpl>> io_thread_host_impl_;
-
 #if defined(OS_LINUX)
   // Provides /proc/{renderer pid}/status and statm files for the renderer,
   // because the files are required to calculate the renderer's private
@@ -1140,6 +1128,19 @@ class CONTENT_EXPORT RenderProcessHostImpl
   std::unique_ptr<TracingServiceController::ClientRegistration>
       tracing_registration_;
 
+  // IOThreadHostImpl owns some IO-thread state associated with this
+  // RenderProcessHostImpl. This is mainly to allow various IPCs from the
+  // renderer to be handled on the IO thread without a hop to the UI thread.
+  //
+  // Declare this at then end to ensure it triggers the destruction of the
+  // IOThreadHostImpl prior to other members with an IO thread deleter that are
+  // bound to a mojo receiver callback using a base::Unretained.  This is
+  // necessary to ensure those objects stop receiving mojo messages before their
+  // destruction.
+  class IOThreadHostImpl;
+  friend class IOThreadHostImpl;
+  base::Optional<base::SequenceBound<IOThreadHostImpl>> io_thread_host_impl_;
+
   base::WeakPtrFactory<RenderProcessHostImpl> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(RenderProcessHostImpl);