Unload the ScopedGaiaAuthExtension asynchronously.

chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc

Index: chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
diff --git a/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc b/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
index 49d6fa2be8503e4b9936a46d654461fbfcf9db15..0df35cb5597b449268285db7ae3ecaa7ab67da0a 100644
--- a/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
+++ b/chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc
@@ -4,6 +4,10 @@
 
 #include "chrome/browser/extensions/signin/scoped_gaia_auth_extension.h"
 
+#include "base/bind.h"
+#include "base/location.h"
+#include "base/single_thread_task_runner.h"
+#include "base/thread_task_runner_handle.h"
 #include "chrome/browser/extensions/signin/gaia_auth_extension_loader.h"
 #include "content/public/browser/browser_context.h"
 
@@ -19,6 +23,15 @@ ScopedGaiaAuthExtension::ScopedGaiaAuthExtension(
 ScopedGaiaAuthExtension::~ScopedGaiaAuthExtension() {
   extensions::GaiaAuthExtensionLoader* loader =
       extensions::GaiaAuthExtensionLoader::Get(browser_context_);
-  if (loader)
-    loader->UnloadIfNeeded();
+  if (loader) {
+    // Post this instead of calling it directly, to ensure that the
+    // RenderFrameHost is not used after being destroyed. This would happen,
+    // for example, if we tried to manually navigate to the extension while
+    // the <webview> containing the Gaia sign in page (and therefore the
+    // extension) was the active tab. See crbug.com/460431.
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::Bind(&extensions::GaiaAuthExtensionLoader::UnloadIfNeeded,
+                   base::Unretained(loader)));

[Alexei Svitkine (slow), 2015/03/05 16:11:38]

Why is it safe to use base::Unretained() here?

What guarantees that the loader won't go away before the task runs?

If there's no good answer to that question, then probably it would be better to
make a method on loader that says loader->UnloadIfNeededAsync() that does a post
task internally with a weak pointer.

[noms (inactive), 2015/03/16 15:57:42]

Done.

+  }
 }