Unload the ScopedGaiaAuthExtension asynchronously.

chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc

Index: chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
diff --git a/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc b/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
index 49d6fa2be8503e4b9936a46d654461fbfcf9db15..2d63fb71e35dc4b7c5977879966f33fb96161674 100644
--- a/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
+++ b/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
@@ -4,8 +4,10 @@
 
 #include "chrome/browser/extensions/signin/scoped_gaia_auth_extension.h"
 
+#include "base/task_runner.h"
 #include "chrome/browser/extensions/signin/gaia_auth_extension_loader.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/browser_thread.h"
 
 ScopedGaiaAuthExtension::ScopedGaiaAuthExtension(
     content::BrowserContext* context)
@@ -19,6 +21,15 @@ ScopedGaiaAuthExtension::ScopedGaiaAuthExtension(
 ScopedGaiaAuthExtension::~ScopedGaiaAuthExtension() {
   extensions::GaiaAuthExtensionLoader* loader =
       extensions::GaiaAuthExtensionLoader::Get(browser_context_);
-  if (loader)
-    loader->UnloadIfNeeded();
+  if (loader) {
+    // Post this instead of calling it directly, to ensure that the
+    // RenderFrameHost is not used after being destroyed. This would happen,
+    // for example, if we tried to manually navigate to the extension while
+    // the <webview> containing the Gaia sign in page (and therefore the
+    // extension) was the active tab. See crbug.com/460431.
+    content::BrowserThread::PostTask(

[xiyuan, 2015/02/25 21:17:30]

nit: Slightly prefer to use base::ThreadTaskRunnerHandle::Get()->PostTask
instead of content::BrowserThread::PostTask because that would make the code
depends on base rather than content.

[noms, 2015/02/25 22:19:27]

Done.

+        content::BrowserThread::UI, FROM_HERE,
+        base::Bind(&extensions::GaiaAuthExtensionLoader::UnloadIfNeeded,
+                   base::Unretained(loader)));
+  }
 }