A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/bho.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/bho.h"
 
 #include <shlguid.h>
 
 #include "base/file_path.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
 #include "base/stringprintf.h"
+#include "base/threading/platform_thread.h"
 #include "base/win/scoped_bstr.h"
-#include "chrome_tab.h" // NOLINT
+#include "chrome_frame/buggy_bho_handling.h"
 #include "chrome_frame/crash_reporting/crash_metrics.h"
 #include "chrome_frame/extra_system_apis.h"
 #include "chrome_frame/html_utils.h"
 #include "chrome_frame/http_negotiate.h"
 #include "chrome_frame/metrics_service.h"
 #include "chrome_frame/protocol_sink_wrap.h"
 #include "chrome_frame/ready_mode/ready_mode.h"
 #include "chrome_frame/urlmon_moniker.h"
 #include "chrome_frame/utils.h"
 #include "chrome_frame/vtable_patch_manager.h"
+#include "chrome_tab.h"  // NOLINT
 
 static const int kIBrowserServiceOnHttpEquivIndex = 30;
 
 PatchHelper g_patch_helper;
 
 BEGIN_VTABLE_PATCHES(IBrowserService)
   VTABLE_PATCH_ENTRY(kIBrowserServiceOnHttpEquivIndex, Bho::OnHttpEquiv)
 END_VTABLE_PATCHES()
 
 _ATL_FUNC_INFO Bho::kBeforeNavigate2Info = {
@@ skipping 91 matching lines @@
       if (browser_service) {
         g_patch_helper.PatchBrowserService(browser_service);
         DCHECK(SUCCEEDED(hr)) << "vtable_patch::PatchInterfaceMethods failed."
             << " Site: " << site << " Error: " << hr;
       }
     }
     // Save away our BHO instance in TLS which enables it to be referenced by
     // our active document/activex instances to query referrer and other
     // information for a URL.
     AddRef();
-    RegisterThreadInstance();
+    RegisterThreadInstance(web_browser2);

[tommi (sloooow) - chröme, 2011/02/11 14:49:02]

Maybe instead of registering a pointer to IWebBrowser2, we should store a vector
of Bho's?  The Bho already has a pointer to the web browser via the site.

     MetricsService::Start();
   } else {
     UnregisterThreadInstance();

[tommi (sloooow) - chröme, 2011/02/11 14:49:02]

Hmm... there's no matching DispEventUnadvise to the DispEventAdvise above...  Is
our Bho ever fully released?

[ananta, 2011/02/11 18:55:07]

Nice catch. Fixed.

+    buggy_bho::BuggyBhoHandler::ClearBuggyObjectsForThread(
+        base::PlatformThread::CurrentId());
     Release();
   }
 
   return IObjectWithSiteImpl<Bho>::SetSite(site);
 }
 
 STDMETHODIMP Bho::BeforeNavigate2(IDispatch* dispatch, VARIANT* url,
     VARIANT* flags, VARIANT* target_frame_name, VARIANT* post_data,
     VARIANT* headers, VARIANT_BOOL* cancel) {
   if (!url || url->vt != VT_BSTR || url->bstrVal == NULL) {
@@ skipping 229 matching lines @@
   }
 }
 
 void PatchHelper::UnpatchIfNeeded() {
   if (state_ == PATCH_PROTOCOL) {
     g_trans_hooks.RevertHooks();
     HttpNegotiatePatch::Uninitialize();
   }
   state_ = UNKNOWN;
 }