This fixes a crash in IE8 with ChromeFrame when a new tab was created. ...

chrome_frame/protocol_sink_wrap.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_FRAME_PROTOCOL_SINK_WRAP_H_
 #define CHROME_FRAME_PROTOCOL_SINK_WRAP_H_
 
 #include <exdisp.h>
 #include <urlmon.h>
 #include <atlbase.h>
 #include <atlcom.h>
 #include <map>
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/ref_counted.h"
 #include "base/scoped_comptr_win.h"
 #include "googleurl/src/gurl.h"
 #include "chrome_frame/ie8_types.h"
+#include "chrome_frame/vtable_patch_manager.h"
 
 // Typedefs for IInternetProtocol and related methods that we patch.
 typedef HRESULT (STDMETHODCALLTYPE* InternetProtocol_Start_Fn)(
     IInternetProtocol* this_object, LPCWSTR url,
     IInternetProtocolSink* prot_sink, IInternetBindInfo* bind_info,
     DWORD flags, HANDLE_PTR reserved);
 typedef HRESULT (STDMETHODCALLTYPE* InternetProtocol_Read_Fn)(
     IInternetProtocol* this_object, void* buffer, ULONG size,
     ULONG* size_read);
 typedef HRESULT (STDMETHODCALLTYPE* InternetProtocol_StartEx_Fn)(
@@ skipping 48 matching lines @@
   COM_INTERFACE_ENTRY_IF_DELEGATE_SUPPORTS(IUriContainer)
   COM_INTERFACE_ENTRY_FUNC_BLIND(0, CheckOutgoingInterface)
 END_COM_MAP()
 
   ProtocolSinkWrap();
   virtual ~ProtocolSinkWrap();
 
   bool Initialize(IInternetProtocol* protocol,
       IInternetProtocolSink* original_sink, const wchar_t* url);
 
-  static bool PatchProtocolHandler(const wchar_t* dll,
-      const CLSID& handler_clsid);
+  // VTable patches the IInternetProtocol and IIntenetProtocolEx interface.
+  // Returns true on success.
+  static bool PatchProtocolHandlers();
+
+  // Unpatches the IInternetProtocol and IInternetProtocolEx interfaces.
+  static void UnpatchProtocolHandlers();
 
   // IInternetProtocol/Ex patches.
   static HRESULT STDMETHODCALLTYPE OnStart(InternetProtocol_Start_Fn orig_start,
       IInternetProtocol* protocol, LPCWSTR url,
       IInternetProtocolSink* prot_sink, IInternetBindInfo* bind_info,
       DWORD flags, HANDLE_PTR reserved);
 
   static HRESULT STDMETHODCALLTYPE OnStartEx(
       InternetProtocol_StartEx_Fn orig_start_ex, IInternetProtocolEx* protocol,
       IUri* uri, IInternetProtocolSink* prot_sink,
@@ skipping 76 matching lines @@
   HRESULT OnReadImpl(void* buffer, ULONG size, ULONG* size_read,
       InternetProtocol_Read_Fn orig_read);
 
   bool is_undetermined() const {
     return (UNDETERMINED == renderer_type_);
   }
   RendererType renderer_type() const {
     return renderer_type_;
   }
 
+  // Creates an instance of the specified protocol handler and returns the
+  // IInternetProtocol interface pointer.
+  // Returns S_OK on success.
+  static HRESULT CreateProtocolHandlerInstance(const CLSID& clsid,
+                                               IInternetProtocol** protocol);
+
+  // Helper function for patching the VTable of the IInternetProtocol
+  // interface. It instantiates the object identified by the protocol_clsid
+  // parameter and patches its VTable.
+  // Returns S_OK on success.
+  static HRESULT PatchProtocolMethods(
+      const CLSID& protocol_clsid,
+      vtable_patch::MethodPatchInfo* protocol_patch_info,
+      vtable_patch::MethodPatchInfo* protocol_ex_patch_info);
+
   // WARNING: Don't use GURL variables here.  Please see
   // http://b/issue?id=2102171 for details.
 
   // Remember original sink
   CComPtr<IInternetProtocolSink> delegate_;
   // Cannot take a reference on the protocol.
   IInternetProtocol* protocol_;
   RendererType renderer_type_;
 
   // Buffer for accumulated data including 1 extra for NULL-terminator
   char buffer_[kMaxContentSniffLength + 1];
   unsigned long buffer_size_;
   unsigned long buffer_pos_;
 
   // Accumulated result
   bool is_saved_result_;
   HRESULT result_code_;
   DWORD result_error_;
   std::wstring result_text_;
-  // For tracking re-entrency and preventing duplicate Read()s from 
+  // For tracking re-entrency and preventing duplicate Read()s from
   // distorting the outcome of ReportData.
   int report_data_recursiveness_;
 
   static ProtocolSinkMap sink_map_;
   // TODO(joshia): Replace with Lock
   static CComAutoCriticalSection sink_map_lock_;
 
   std::wstring url_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ProtocolSinkWrap);
 };
 
 
 #endif  // CHROME_FRAME_PROTOCOL_SINK_WRAP_H_