Unload the ScopedGaiaAuthExtension asynchronously.

chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/signin/scoped_gaia_auth_extension.h"
 
+#include "base/task_runner.h"
 #include "chrome/browser/extensions/signin/gaia_auth_extension_loader.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/browser_thread.h"
 
 ScopedGaiaAuthExtension::ScopedGaiaAuthExtension(
     content::BrowserContext* context)
     : browser_context_(context) {
   extensions::GaiaAuthExtensionLoader* loader =
       extensions::GaiaAuthExtensionLoader::Get(browser_context_);
   if (loader)
     loader->LoadIfNeeded();
 }
 
 ScopedGaiaAuthExtension::~ScopedGaiaAuthExtension() {
   extensions::GaiaAuthExtensionLoader* loader =
       extensions::GaiaAuthExtensionLoader::Get(browser_context_);
-  if (loader)
-    loader->UnloadIfNeeded();
+  if (loader) {
+    // Post this instead of calling it directly, to ensure that the
+    // RenderFrameHost is not used after being destroyed. This would happen,
+    // for example, if we tried to manually navigate to the extension while
+    // the <webview> containing the Gaia sign in page (and therefore the
+    // extension) was the active tab. See crbug.com/460431.
+    content::BrowserThread::PostTask(

[xiyuan, 2015/02/25 21:17:30]

nit: Slightly prefer to use base::ThreadTaskRunnerHandle::Get()->PostTask
instead of content::BrowserThread::PostTask because that would make the code
depends on base rather than content.

[noms, 2015/02/25 22:19:27]

Done.

+        content::BrowserThread::UI, FROM_HERE,
+        base::Bind(&extensions::GaiaAuthExtensionLoader::UnloadIfNeeded,
+                   base::Unretained(loader)));
+  }
 }