Postpone deletion of (Password)AutofillAgent

components/autofill/content/renderer/password_autofill_agent.cc

Index: components/autofill/content/renderer/password_autofill_agent.cc
diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index ce485ac91a149483af76227c72d83e372025aace..d0245ece9c365df0d262abbacd2677253d050941 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc
@@ -1237,6 +1237,14 @@ void PasswordAutofillAgent::WillSubmitForm(const blink::WebFormElement& form) {
   }
 }
 
+void PasswordAutofillAgent::OnDestruct() {
+  // As described in http://crbug.com/608100, there might be an AutofillAgent
+  // method in-progress lower on the stack. Destroying |this| would cause
+  // use-after-free once the lower stack frame becomes active. Instead, a task
+  // needs to be posted to delete this.
+  base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
+}
+
 void PasswordAutofillAgent::DidStartProvisionalLoad() {
   std::unique_ptr<RendererSavePasswordProgressLogger> logger;
   if (logging_state_active_) {