Fix crash in app list view delegate.

chrome/browser/ui/app_list/app_list_view_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/app_list/app_list_view_delegate.h"
 
 #include <stddef.h>
 
 #include <vector>
 
@@ skipping 237 matching lines @@
     app_list::StartPageService* start_page_service =
         app_list::StartPageService::Get(profile_);
     if (start_page_service)
       start_page_service->RemoveObserver(this);
 #if defined(USE_ASH)
     app_sync_ui_state_watcher_.reset();
 #endif
     model_ = NULL;
   }
 
+  template_url_service_observer_.RemoveAll();
+
   profile_ = new_profile;
   if (!profile_) {
     speech_ui_->SetSpeechRecognitionState(app_list::SPEECH_RECOGNITION_OFF,
                                           false);
     return;
   }
 
   // If we are in guest mode, the new profile should be an incognito profile.
   // Otherwise, this may later hit a check (same condition as this one) in
   // Browser::Browser when opening links in a browser window (see
   // http://crbug.com/460437).
   DCHECK(!profile_->IsGuestSession() || profile_->IsOffTheRecord())
       << "Guest mode must use incognito profile";
 
   {
     // TODO(tapted): Remove ScopedTracker below once crbug.com/431326 is fixed.
     tracked_objects::ScopedTracker tracking_profile(
         FROM_HERE_WITH_EXPLICIT_FUNCTION(
             "431326 AppListViewDelegate TemplateURL etc."));
-    template_url_service_observer_.RemoveAll();
     if (app_list::switches::IsExperimentalAppListEnabled()) {
       TemplateURLService* template_url_service =
           TemplateURLServiceFactory::GetForProfile(profile_);
       template_url_service_observer_.Add(template_url_service);
     }
 
     model_ = app_list::AppListSyncableServiceFactory::GetForProfile(profile_)
                  ->GetModel();
 
 #if defined(USE_ASH)
@@ skipping 560 matching lines @@
   FOR_EACH_OBSERVER(app_list::AppListViewDelegateObserver, observers_,
                     OnShutdown());
 
   SetProfile(nullptr);  // Ensures launcher page web contents are torn down.
 
   // SigninManagerFactory is not a leaky singleton (unlike this class), and
   // its destructor will check that it has no remaining observers.
   scoped_observer_.RemoveAll();
   SigninManagerFactory::GetInstance()->RemoveObserver(this);
 }