Always destroy CrxInstaller on the UI Thread

extensions/browser/sandboxed_unpacker.h

Index: extensions/browser/sandboxed_unpacker.h
diff --git a/extensions/browser/sandboxed_unpacker.h b/extensions/browser/sandboxed_unpacker.h
index 99a1ebbba84a5a0154bd92957ef1f980b93511c9..74b5e193268abcc80d16b71def3d411ed9f19940 100644
--- a/extensions/browser/sandboxed_unpacker.h
+++ b/extensions/browser/sandboxed_unpacker.h
@@ -9,7 +9,7 @@
 
 #include "base/files/file_path.h"
 #include "base/files/scoped_temp_dir.h"
-#include "base/memory/ref_counted.h"
+#include "base/memory/ref_counted_delete_on_message_loop.h"
 #include "base/time/time.h"
 #include "content/public/browser/utility_process_host_client.h"
 #include "extensions/browser/crx_file_info.h"
@@ -31,8 +31,10 @@ namespace extensions {
 class Extension;
 
 class SandboxedUnpackerClient
-    : public base::RefCountedThreadSafe<SandboxedUnpackerClient> {
+    : public base::RefCountedDeleteOnMessageLoop<SandboxedUnpackerClient> {
  public:
+  SandboxedUnpackerClient(const scoped_refptr<base::MessageLoopProxy>& loop);
+
   // temp_dir - A temporary directory containing the results of the extension
   // unpacking. The client is responsible for deleting this directory.
   //
@@ -53,7 +55,8 @@ class SandboxedUnpackerClient
   virtual void OnUnpackFailure(const CrxInstallError& error) = 0;
 
  protected:
-  friend class base::RefCountedThreadSafe<SandboxedUnpackerClient>;
+  friend class base::RefCountedDeleteOnMessageLoop<SandboxedUnpackerClient>;
+  friend class base::DeleteHelper<SandboxedUnpackerClient>;
 
   virtual ~SandboxedUnpackerClient() {}
 };