Unload the ScopedGaiaAuthExtension asynchronously.

If we don't do this, then we have a race condition between unloading
this extension, and trying to use it because we have manually
navigated to it.

BUG=460431

Review URL: https://codereview.chromium.org/961443003

Cr-Commit-Position: refs/heads/master@{#318140}

chrome/browser/extensions/signin/scoped_gaia_auth_extension.cc

@@ -4,6 +4,10 @@
 
 #include "chrome/browser/extensions/signin/scoped_gaia_auth_extension.h"
 
+#include "base/bind.h"
+#include "base/location.h"
+#include "base/single_thread_task_runner.h"
+#include "base/thread_task_runner_handle.h"
 #include "chrome/browser/extensions/signin/gaia_auth_extension_loader.h"
 #include "content/public/browser/browser_context.h"
 
@@ -19,6 +23,15 @@ ScopedGaiaAuthExtension::ScopedGaiaAuthExtension(
 ScopedGaiaAuthExtension::~ScopedGaiaAuthExtension() {
   extensions::GaiaAuthExtensionLoader* loader =
       extensions::GaiaAuthExtensionLoader::Get(browser_context_);
-  if (loader)
-    loader->UnloadIfNeeded();
+  if (loader) {
+    // Post this instead of calling it directly, to ensure that the
+    // RenderFrameHost is not used after being destroyed. This would happen,
+    // for example, if we tried to manually navigate to the extension while
+    // the <webview> containing the Gaia sign in page (and therefore the
+    // extension) was the active tab. See crbug.com/460431.
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        base::Bind(&extensions::GaiaAuthExtensionLoader::UnloadIfNeeded,
+                   base::Unretained(loader)));
+  }
 }