ash/mus: Fix a crash during tear down.

ash/mus/window_manager.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ash/mus/window_manager.h"
 
 #include <stdint.h>
 
 #include <utility>
 
@@ skipping 196 matching lines @@
 void WindowManager::OnEmbed(ui::Window* root) {
   // WindowManager should never see this, instead OnWmNewDisplay() is called.
   NOTREACHED();
 }
 
 void WindowManager::OnDidDestroyClient(ui::WindowTreeClient* client) {
   // Destroying the roots should result in removal from
   // |root_window_controllers_|.
   DCHECK(root_window_controllers_.empty());
 
+  // Observers can rely on WmShell from the callback. So notify the observers
+  // before destroying it.
+  FOR_EACH_OBSERVER(WindowManagerObserver, observers_,
+                    OnWindowTreeClientDestroyed());
+
   lookup_.reset();
   shell_->Shutdown();
   shell_.reset();
   shadow_controller_.reset();
 
-  FOR_EACH_OBSERVER(WindowManagerObserver, observers_,
-                    OnWindowTreeClientDestroyed());
-
   pointer_watcher_event_router_.reset();
 
   window_tree_client_ = nullptr;
   window_manager_client_ = nullptr;
 }
 
 void WindowManager::OnPointerEventObserved(const ui::PointerEvent& event,
                                            ui::Window* target) {
   pointer_watcher_event_router_->OnPointerEventObserved(event, target);
 }
@@ skipping 71 matching lines @@
                                                     const ui::Event& event) {
   auto iter = accelerator_handlers_.find(GetAcceleratorNamespaceId(id));
   if (iter == accelerator_handlers_.end())
     return ui::mojom::EventResult::HANDLED;
 
   return iter->second->OnAccelerator(id, event);
 }
 
 }  // namespace mus
 }  // namespace ash