extensions: Destroy ExtensionMessageFilter on IO thread.

extensions/browser/extension_message_filter.h

Index: extensions/browser/extension_message_filter.h
diff --git a/extensions/browser/extension_message_filter.h b/extensions/browser/extension_message_filter.h
index 330579464d3bd3cbc3546e04f081b55480050d01..1ed785e5c8dea4695d1a223fab89687a59b087a7 100644
--- a/extensions/browser/extension_message_filter.h
+++ b/extensions/browser/extension_message_filter.h
@@ -38,12 +38,16 @@ class ExtensionMessageFilter : public content::BrowserMessageFilter {
   int render_process_id() { return render_process_id_; }
 
  private:
+  friend class content::BrowserThread;
+  friend class base::DeleteHelper<ExtensionMessageFilter>;
+
   virtual ~ExtensionMessageFilter();
 
   // content::BrowserMessageFilter implementation.
   virtual void OverrideThreadForMessage(
       const IPC::Message& message,
       content::BrowserThread::ID* thread) OVERRIDE;
+  virtual void OnDestruct() const OVERRIDE;
   virtual bool OnMessageReceived(const IPC::Message& message) OVERRIDE;
 
   // Message handlers on the UI thread.
@@ -82,6 +86,7 @@ class ExtensionMessageFilter : public content::BrowserMessageFilter {
 
   scoped_refptr<extensions::InfoMap> extension_info_map_;
 
+  // Weak pointers produced by this factory are bound to the IO thread.
   base::WeakPtrFactory<ExtensionMessageFilter> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionMessageFilter);