A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/chrome_active_document.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Implementation of ChromeActiveDocument
 #include "chrome_frame/chrome_active_document.h"
 
 #include <hlink.h>
 #include <htiface.h>
 #include <initguid.h>
@@ skipping 720 matching lines @@
         break;
       default:
         break;
     }
 
     base::win::ScopedVariant secure_lock_status(lock_status);
     IEExec(&CGID_ShellDocView, INTERNAL_CMDID_SET_SSL_LOCK,
            OLECMDEXECOPT_DODEFAULT, secure_lock_status.AsInput(), NULL);
   }
 
+  // A number of poorly written bho's crash in their event sink callbacks if
+  // chrome frame is the currently loaded document. This is because they expect
+  // chrome frame to implement interfaces like IHTMLDocument, etc. We patch the
+  // event sink's of these bho's and don't invoke the event sink if chrome
+  // frame is the currently loaded document.
+  if (GetConfigBool(true, kEnableBuggyBhoIntercept)) {
+    ScopedComPtr<IWebBrowser2> wb2;
+    DoQueryService(SID_SWebBrowserApp, m_spClientSite, wb2.Receive());
+    if (wb2 && buggy_bho::BuggyBhoTls::GetInstance()) {
+      buggy_bho::BuggyBhoTls::GetInstance()->PatchBuggyBHOs(wb2);
+    }
+  }
+
   // Ideally all navigations should come to Chrome Frame so that we can call
   // BeforeNavigate2 on installed BHOs and give them a chance to cancel the
   // navigation. However, in practice what happens is as below:
   // The very first navigation that happens in CF happens via a Load or a
   // LoadHistory call. In this case, IE already has the correct information for
   // its travel log as well address bar. For other internal navigations (navs
   // that only happen within Chrome such as anchor navigations) we need to
   // update IE's internal state after the fact. In the case of internal
   // navigations, we notify the BHOs but ignore the should_cancel flag.
 
@@ skipping 10 matching lines @@
   bool is_internal_navigation =
       IsNewNavigation(new_navigation_info, flags) || is_attach_external_tab_url;
 
   if (new_navigation_info.url.is_valid())
     url_.Allocate(UTF8ToWide(new_navigation_info.url.spec()).c_str());
 
   if (is_internal_navigation) {
     ScopedComPtr<IDocObjectService> doc_object_svc;
     ScopedComPtr<IWebBrowserEventsService> web_browser_events_svc;
 
-    buggy_bho::BuggyBhoTls bad_bho_tls;
-    if (GetConfigBool(true, kEnableBuggyBhoIntercept)) {
-      ScopedComPtr<IWebBrowser2> wb2;
-      DoQueryService(SID_SWebBrowserApp, m_spClientSite, wb2.Receive());
-      if (wb2) {
-        buggy_bho::BuggyBhoTls::PatchBuggyBHOs(wb2);
-      }
-    }
-
     DoQueryService(__uuidof(web_browser_events_svc), m_spClientSite,
                    web_browser_events_svc.Receive());
 
     if (!web_browser_events_svc.get()) {
       DoQueryService(SID_SShellBrowser, m_spClientSite,
                      doc_object_svc.Receive());
     }
 
     // web_browser_events_svc can be NULL on IE6.
     if (web_browser_events_svc) {
@@ skipping 604 matching lines @@
     return true;
 
   if (new_navigation_info.url != navigation_info_->url)
     return true;
 
   if (new_navigation_info.referrer != navigation_info_->referrer)
     return true;
 
   return false;
 }