<webview>: Speculative fix

content/renderer/child_frame_compositing_helper.h

Index: content/renderer/child_frame_compositing_helper.h
diff --git a/content/renderer/child_frame_compositing_helper.h b/content/renderer/child_frame_compositing_helper.h
index 1ec0585360b7375dc69fcd9ff4aaf170443d4a33..b440e39d90136f3a320f2727607e5f35e46add4b 100644
--- a/content/renderer/child_frame_compositing_helper.h
+++ b/content/renderer/child_frame_compositing_helper.h
@@ -151,6 +151,12 @@ class CONTENT_EXPORT ChildFrameCompositingHelper
 
   gfx::Size buffer_size_;
 
+  // The lifetime of this weak pointer should be greater than the lifetime of
+  // other member objects, as they may access this pointer during their
+  // destruction.
+  base::WeakPtr<BrowserPlugin> browser_plugin_;
+  RenderFrameImpl* render_frame_;
+
   scoped_refptr<cc::DelegatedFrameResourceCollection> resource_collection_;
   scoped_refptr<cc::DelegatedFrameProvider> frame_provider_;
 
@@ -160,9 +166,6 @@ class CONTENT_EXPORT ChildFrameCompositingHelper
   scoped_ptr<blink::WebLayer> web_layer_;
   blink::WebFrame* frame_;
 
-  base::WeakPtr<BrowserPlugin> browser_plugin_;
-  RenderFrameImpl* render_frame_;
-
   DISALLOW_COPY_AND_ASSIGN(ChildFrameCompositingHelper);
 };