A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/chrome_active_document.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Implementation of ChromeActiveDocument
 #include "chrome_frame/chrome_active_document.h"
 
 #include <hlink.h>
 #include <htiface.h>
 #include <initguid.h>
@@ skipping 750 matching lines @@
   bool is_internal_navigation =
       IsNewNavigation(new_navigation_info, flags) || is_attach_external_tab_url;
 
   if (new_navigation_info.url.is_valid())
     url_.Allocate(UTF8ToWide(new_navigation_info.url.spec()).c_str());
 
   if (is_internal_navigation) {
     ScopedComPtr<IDocObjectService> doc_object_svc;
     ScopedComPtr<IWebBrowserEventsService> web_browser_events_svc;
 
-    buggy_bho::BuggyBhoTls bad_bho_tls;
     if (GetConfigBool(true, kEnableBuggyBhoIntercept)) {
       ScopedComPtr<IWebBrowser2> wb2;
       DoQueryService(SID_SWebBrowserApp, m_spClientSite, wb2.Receive());
-      if (wb2) {
-        buggy_bho::BuggyBhoTls::PatchBuggyBHOs(wb2);
+      if (wb2 && buggy_bho::BuggyBhoTls::GetInstance()) {
+        buggy_bho::BuggyBhoTls::GetInstance()->PatchBuggyBHOs(wb2);
       }
     }
 
     DoQueryService(__uuidof(web_browser_events_svc), m_spClientSite,
                    web_browser_events_svc.Receive());
 
     if (!web_browser_events_svc.get()) {
       DoQueryService(SID_SShellBrowser, m_spClientSite,
                      doc_object_svc.Receive());
     }
@@ skipping 607 matching lines @@
     return true;
 
   if (new_navigation_info.url != navigation_info_->url)
     return true;
 
   if (new_navigation_info.referrer != navigation_info_->referrer)
     return true;
 
   return false;
 }