Fix heap-use-after-free surfaced by https://crrev.com/2672753002

components/history/core/browser/history_backend.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef COMPONENTS_HISTORY_CORE_BROWSER_HISTORY_BACKEND_H_
 #define COMPONENTS_HISTORY_CORE_BROWSER_HISTORY_BACKEND_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 854 matching lines @@
   // Used to determine if a URL is bookmarked; may be null.
   std::unique_ptr<HistoryBackendClient> backend_client_;
 
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
 
   // Used to allow embedder code to stash random data by key. Those object will
   // be deleted before closing the databases (hence the member variable instead
   // of inheritance from base::SupportsUserData).
   std::unique_ptr<HistoryBackendHelper> supports_user_data_helper_;
 
-  // Used to manage syncing of the typed urls datatype. This will be null before
-  // Init is called.
-  std::unique_ptr<TypedUrlSyncableService> typed_url_syncable_service_;
-
   // Listens for the system being under memory pressure.
   std::unique_ptr<base::MemoryPressureListener> memory_pressure_listener_;
 
   // Contains diagnostic information about the sql database that is non-empty
   // when a catastrophic error occurs.
   std::string db_diagnostics_;
 
   // Map from host to index in the TopHosts list. It is updated only by
   // TopHosts(), so it's usually stale.
   mutable base::hash_map<std::string, int> host_ranks_;
 
   // List of observers
   base::ObserverList<HistoryBackendObserver> observers_;
 
+  // Used to manage syncing of the typed urls datatype. This will be null before
+  // Init is called. Defined after observers_ because it unregisters itself as
+  // observer during destruction.
+  std::unique_ptr<TypedUrlSyncableService> typed_url_syncable_service_;
+
   DISALLOW_COPY_AND_ASSIGN(HistoryBackend);
 };
 
 }  // namespace history
 
 #endif  // COMPONENTS_HISTORY_CORE_BROWSER_HISTORY_BACKEND_H_