A number of poorly written IE BHO's crash IE if ChromeFrame is the currently ...

chrome_frame/urlmon_moniker.h

Index: chrome_frame/urlmon_moniker.h
===================================================================
--- chrome_frame/urlmon_moniker.h	(revision 74374)
+++ chrome_frame/urlmon_moniker.h	(working copy)
@@ -7,12 +7,14 @@
 
 #include <atlbase.h>
 #include <atlcom.h>
+#include <ExDisp.h>
 #include <urlmon.h>
 #include <string>
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/threading/thread_local.h"
+#include "base/win/scoped_comptr.h"
 #include "base/win/scoped_variant.h"
 #include "googleurl/src/gurl.h"
 #include "chrome_frame/utils.h"
@@ -88,7 +90,7 @@
   // TLS.  Returns NULL if no instance exists on the current thread.
   static NavigationManager* GetThreadInstance();
 
-  void RegisterThreadInstance();
+  void RegisterThreadInstance(IWebBrowser2* web_browser2);
   void UnregisterThreadInstance();
 
   virtual ~NavigationManager() {
@@ -150,6 +152,10 @@
     return headers_;
   }
 
+  IWebBrowser2* web_browser() {
+    return web_browser2_.get();
+  }
+
  protected:
   std::string referrer_;
   std::wstring url_;
@@ -158,6 +164,9 @@
 
   static base::LazyInstance<base::ThreadLocalPointer<NavigationManager> >
       thread_singleton_;
+  // The IWebBrowser2 instance associated with this NavigationManager
+  // instance.
+  base::win::ScopedComPtr<IWebBrowser2> web_browser2_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(NavigationManager);