A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/urlmon_moniker.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/urlmon_moniker.h"
 
 #include <shlguid.h>
 
 #include "base/string_util.h"
 #include "base/stringprintf.h"
@@ skipping 63 matching lines @@
 bool NavigationManager::IsTopLevelUrl(const wchar_t* url) {
   return CompareUrlsWithoutFragment(url_.c_str(), url);
 }
 
 /////////////////////////////////////////
 
 NavigationManager* NavigationManager::GetThreadInstance() {
   return thread_singleton_.Pointer()->Get();
 }
 
-void NavigationManager::RegisterThreadInstance() {
+void NavigationManager::RegisterThreadInstance(IWebBrowser2* web_browser2) {
   DCHECK(GetThreadInstance() == NULL);
+  DCHECK(web_browser2 != NULL);
   thread_singleton_.Pointer()->Set(this);
+  web_browser2_ = web_browser2;
 }
 
 void NavigationManager::UnregisterThreadInstance() {
   DCHECK(GetThreadInstance() == this);
   thread_singleton_.Pointer()->Set(NULL);
+  web_browser2_.Release();
 }
 
 /////////////////////////////////////////
 
 // static
 bool MonikerPatch::Initialize() {
   if (IS_PATCHED(IMoniker)) {
     DLOG(WARNING) << __FUNCTION__ << " called more than once.";
     return true;
   }
@@ skipping 147 matching lines @@
 
   // If the binding terminates before the data could be played back
   // now is the chance. Sometimes OnStopBinding happens after this returns
   // and then it's too late.
   if ((S_OK == hr) && callback)
     callback->MayPlayBack(BSCF_LASTDATANOTIFICATION);
 
   return hr;
 }