Fix mojo::shell::Context shutdown.

shell/context.h

Index: shell/context.h
diff --git a/shell/context.h b/shell/context.h
index 4d2cf341aa9dacf52db7cec46e2d4c5249728779..62c49c2f3ecf8b0a09e540e1db7516d05c912e03 100644
--- a/shell/context.h
+++ b/shell/context.h
@@ -26,6 +26,8 @@ class Context : ApplicationManager::Delegate, embedder::ProcessDelegate {
   Context();
   ~Context() override;
 
+  static void EnsureEmbedderIsInitialized();
+
   // Point to the directory containing installed services, such as the network
   // service. By default this directory is used as the base URL for resolving
   // unknown mojo: URLs. The network service will be loaded from this directory,
@@ -44,9 +46,14 @@ class Context : ApplicationManager::Delegate, embedder::ProcessDelegate {
   // nop for everything but relative file URLs or URLs without a scheme.
   GURL ResolveCommandLineURL(const std::string& path);
 
-  static void EnsureEmbedderIsInitialized();
+  // This must be called with a message loop set up for the current thread,
+  // which must remain alive until after Shutdown() is called. Returns true on
+  // success.
   bool Init();
 
+  // If Init() was called and succeeded, this must be called before destruction.
+  void Shutdown();
+
   void Run(const GURL& url);
   ScopedMessagePipeHandle ConnectToServiceByName(
       const GURL& application_url,
@@ -59,8 +66,6 @@ class Context : ApplicationManager::Delegate, embedder::ProcessDelegate {
  private:
   class NativeViewportApplicationLoader;
 
-  void Shutdown();
-
   // ApplicationManager::Delegate overrides.
   void OnApplicationError(const GURL& url) override;
   GURL ResolveURL(const GURL& url) override;