Fix heap-use-after-free surfaced by https://crrev.com/2672753002

components/history/core/browser/history_backend.h

Index: components/history/core/browser/history_backend.h
diff --git a/components/history/core/browser/history_backend.h b/components/history/core/browser/history_backend.h
index 82166f7e721a3c5d8d0667429b39ad39487e7238..2a62a79deccf02c0276c3ab2b043e86708491a9f 100644
--- a/components/history/core/browser/history_backend.h
+++ b/components/history/core/browser/history_backend.h
@@ -872,10 +872,6 @@ class HistoryBackend : public base::RefCountedThreadSafe<HistoryBackend>,
   // of inheritance from base::SupportsUserData).
   std::unique_ptr<HistoryBackendHelper> supports_user_data_helper_;
 
-  // Used to manage syncing of the typed urls datatype. This will be null before
-  // Init is called.
-  std::unique_ptr<TypedUrlSyncableService> typed_url_syncable_service_;
-
   // Listens for the system being under memory pressure.
   std::unique_ptr<base::MemoryPressureListener> memory_pressure_listener_;
 
@@ -890,6 +886,11 @@ class HistoryBackend : public base::RefCountedThreadSafe<HistoryBackend>,
   // List of observers
   base::ObserverList<HistoryBackendObserver> observers_;
 
+  // Used to manage syncing of the typed urls datatype. This will be null before
+  // Init is called. Defined after observers_ because it unregisters itself as
+  // observer during destruction.
+  std::unique_ptr<TypedUrlSyncableService> typed_url_syncable_service_;
+
   DISALLOW_COPY_AND_ASSIGN(HistoryBackend);
 };