Fix a crash bug on deallocating CWVWebView.

ios/web_view/internal/cwv_web_view.mm

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web_view/public/cwv_web_view.h"
 
 #include <memory>
 #include <utility>
 
 #import "base/ios/weak_nsobject.h"
@@ skipping 21 matching lines @@
 #import "net/base/mac/url_conversions.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
 
 namespace {
 // A key used in NSCoder to store the session storage object.
 NSString* const kSessionStorageKey = @"sessionStorage";
 }
 
 @interface CWVWebView ()<CRWWebStateDelegate, CRWWebStateObserver> {
+  // |_configuration| must come before |_webState| here to avoid crash on
+  // deallocating CWVWebView. This is because the destructor of |_webState|
+  // indirectly accesses the BrowserState instance, which is owned by
+  // |_configuration|.
+  //
+  // Looks like the fields of the object are deallocated in the reverse order of
+  // their definition. If |_webState| comes before |_configuration|, the order
+  // of execution is like this:
+  //
+  // 1. |_configuration| is deallocated
+  // 1.1. BrowserState is deallocated
+  // 2. |_webState| is deallocated
+  // 2.1. The destructor of |_webState| indirectly accesses the BrowserState
+  //      deallocated above, causing crash.
+  //
+  // See crbug.com/712556 for the full stack trace.
+  CWVWebViewConfiguration* _configuration;
   std::unique_ptr<web::WebState> _webState;
   std::unique_ptr<web::WebStateDelegateBridge> _webStateDelegate;
   std::unique_ptr<web::WebStateObserverBridge> _webStateObserver;
   std::unique_ptr<ios_web_view::WebViewWebStatePolicyDecider>
       _webStatePolicyDecider;
   double _estimatedProgress;
   // Handles presentation of JavaScript dialogs.
   std::unique_ptr<ios_web_view::WebViewJavaScriptDialogPresenter>
       _javaScriptDialogPresenter;
 }
@@ skipping 264 matching lines @@
   if (subview.superview == self) {
     return;
   }
   subview.frame = self.bounds;
   subview.autoresizingMask =
       UIViewAutoresizingFlexibleWidth | UIViewAutoresizingFlexibleHeight;
   [self addSubview:subview];
 }
 
 @end