Have ExtensionHost use TabContents instead of RenderViewHost. Try #3.

chrome/browser/ui/views/extensions/extension_popup.cc

Index: chrome/browser/ui/views/extensions/extension_popup.cc
diff --git a/chrome/browser/ui/views/extensions/extension_popup.cc b/chrome/browser/ui/views/extensions/extension_popup.cc
index 654db01b58e0e6597338f64cb15775685d10990a..4c1b051489759eb69e21511144572bd3bbe7befb 100644
--- a/chrome/browser/ui/views/extensions/extension_popup.cc
+++ b/chrome/browser/ui/views/extensions/extension_popup.cc
@@ -17,6 +17,7 @@
 #include "chrome/common/extensions/extension.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/renderer_host/render_widget_host_view.h"
+#include "content/browser/tab_contents/tab_contents.h"
 #include "content/public/browser/notification_details.h"
 #include "content/public/browser/notification_source.h"
 #include "views/widget/root_view.h"
@@ -70,6 +71,9 @@ ExtensionPopup::ExtensionPopup(
 }
 
 ExtensionPopup::~ExtensionPopup() {
+  // Clear the delegate, because we might trigger UI events during destruction,
+  // and we don't want to be called into anymore.
+  set_delegate(NULL);

[Matt Perry, 2011/11/16 21:44:10]

This fixes the crash bug I mention. (BrowserBubble::SetFocus was being called,
which tries to call back into the delegate if it's non-NULL.)

 }
 
 void ExtensionPopup::Show(bool activate) {
@@ -95,7 +99,7 @@ void ExtensionPopup::BubbleBrowserWindowClosing(BrowserBubble* bubble) {
 
 void ExtensionPopup::BubbleGotFocus(BrowserBubble* bubble) {
   // Forward the focus to the renderer.
-  host()->render_view_host()->view()->Focus();
+  host()->host_contents()->Focus();
 }
 
 void ExtensionPopup::BubbleLostFocus(BrowserBubble* bubble,