A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/bho.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome_frame/bho.h"
 
 #include <shlguid.h>
 
 #include "base/file_path.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
 #include "base/stringprintf.h"
 #include "base/win/scoped_bstr.h"
-#include "chrome_tab.h" // NOLINT
+#include "chrome_frame/buggy_bho_handling.h"
 #include "chrome_frame/crash_reporting/crash_metrics.h"
 #include "chrome_frame/extra_system_apis.h"
 #include "chrome_frame/html_utils.h"
 #include "chrome_frame/http_negotiate.h"
 #include "chrome_frame/metrics_service.h"
 #include "chrome_frame/protocol_sink_wrap.h"
 #include "chrome_frame/ready_mode/ready_mode.h"
 #include "chrome_frame/urlmon_moniker.h"
 #include "chrome_frame/utils.h"
 #include "chrome_frame/vtable_patch_manager.h"
@@ skipping 105 matching lines @@
       }
     }
     // Save away our BHO instance in TLS which enables it to be referenced by
     // our active document/activex instances to query referrer and other
     // information for a URL.
     AddRef();
     RegisterThreadInstance();
     MetricsService::Start();
   } else {
     UnregisterThreadInstance();
+    buggy_bho::BuggyBhoTls::DestroyInstance();
+    ScopedComPtr<IWebBrowser2> web_browser2;
+    web_browser2.QueryFrom(m_spUnkSite);
+    DispEventUnadvise(web_browser2, &DIID_DWebBrowserEvents2);
     Release();
   }
 
   return IObjectWithSiteImpl<Bho>::SetSite(site);
 }
 
 STDMETHODIMP Bho::BeforeNavigate2(IDispatch* dispatch, VARIANT* url,
     VARIANT* flags, VARIANT* target_frame_name, VARIANT* post_data,
     VARIANT* headers, VARIANT_BOOL* cancel) {
   if (!url || url->vt != VT_BSTR || url->bstrVal == NULL) {
@@ skipping 229 matching lines @@
   }
 }
 
 void PatchHelper::UnpatchIfNeeded() {
   if (state_ == PATCH_PROTOCOL) {
     g_trans_hooks.RevertHooks();
     HttpNegotiatePatch::Uninitialize();
   }
   state_ = UNKNOWN;
 }