Have ExtensionHost use TabContents instead of RenderViewHost. Try #3.

chrome/browser/ui/views/extensions/extension_popup.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/views/extensions/extension_popup.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "chrome/browser/debugger/devtools_window.h"
 #include "chrome/browser/extensions/extension_host.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/common/chrome_notification_types.h"
 #include "chrome/common/extensions/extension.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/renderer_host/render_widget_host_view.h"
+#include "content/browser/tab_contents/tab_contents.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_source.h"
 #include "views/widget/root_view.h"
 #include "views/widget/widget.h"
 
 #if defined(OS_CHROMEOS) && defined(TOOLKIT_USES_GTK)
 #include "chrome/browser/chromeos/wm_ipc.h"
 #include "third_party/cros_system_api/window_manager/chromeos_wm_ipc_enums.h"
 #endif
 
@@ skipping 33 matching lines @@
   registrar_.Add(this,
                  chrome::NOTIFICATION_EXTENSION_HOST_DID_STOP_LOADING,
                  content::Source<Profile>(host->profile()));
 
   // Listen for the containing view calling window.close();
   registrar_.Add(this, chrome::NOTIFICATION_EXTENSION_HOST_VIEW_SHOULD_CLOSE,
                  content::Source<Profile>(host->profile()));
 }
 
 ExtensionPopup::~ExtensionPopup() {
+  // Clear the delegate, because we might trigger UI events during destruction,
+  // and we don't want to be called into anymore.
+  set_delegate(NULL);

[Matt Perry, 2011/11/16 21:44:10]

This fixes the crash bug I mention. (BrowserBubble::SetFocus was being called,
which tries to call back into the delegate if it's non-NULL.)

 }
 
 void ExtensionPopup::Show(bool activate) {
   if (popup_->IsVisible())
     return;
 
 #if defined(OS_WIN)
   frame_->GetTopLevelWidget()->DisableInactiveRendering();
 #endif
 
   ResizeToView();
   BrowserBubble::Show(activate);
 }
 
 void ExtensionPopup::BubbleBrowserWindowMoved(BrowserBubble* bubble) {
   ResizeToView();
 }
 
 void ExtensionPopup::BubbleBrowserWindowClosing(BrowserBubble* bubble) {
   if (!closing_)
     Close();
 }
 
 void ExtensionPopup::BubbleGotFocus(BrowserBubble* bubble) {
   // Forward the focus to the renderer.
-  host()->render_view_host()->view()->Focus();
+  host()->host_contents()->Focus();
 }
 
 void ExtensionPopup::BubbleLostFocus(BrowserBubble* bubble,
     bool lost_focus_to_child) {
   if (closing_ ||                // We are already closing.
       inspect_with_devtools_ ||  // The popup is being inspected.
       !close_on_lost_focus_ ||   // Our client is handling focus listening.
       lost_focus_to_child)       // A child of this view got focus.
     return;
 
@@ skipping 96 matching lines @@
   if (closing_)
     return;
   closing_ = true;
   DetachFromBrowser();
 
   if (observer_)
     observer_->ExtensionPopupIsClosing(this);
 
   Release();  // Balanced in ctor.
 }