The ChromeFrameAutomationClient class needs to be refcounted as it implements...

chrome_frame/chrome_frame_activex_base.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_
 #define CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_
 
 #include <atlbase.h>
 #include <atlcom.h>
 #include <atlctl.h>
@@ skipping 116 matching lines @@
                          args,
                          arraysize(args));
   }
 };
 
 extern bool g_first_launch_by_process_;
 
 // Common implementation for ActiveX and Active Document
 template <class T, const CLSID& class_id>
 class ATL_NO_VTABLE ChromeFrameActivexBase :
-  public CComObjectRootEx<CComSingleThreadModel>,
+  public CComObjectRootEx<CComMultiThreadModel>,
   public IOleControlImpl<T>,
   public IOleObjectImpl<T>,
   public IOleInPlaceActiveObjectImpl<T>,
   public IViewObjectExImpl<T>,
   public IOleInPlaceObjectWindowlessImpl<T>,
   public ISupportErrorInfo,
   public IQuickActivateImpl<T>,
   public com_util::IProvideClassInfo2Impl<class_id,
                                           DIID_DIChromeFrameEvents>,
   public com_util::IDispatchImpl<IChromeFrame>,
@@ skipping 353 matching lines @@
     }
     return 0;
   }
 
   LRESULT OnDestroy(UINT message, WPARAM wparam, LPARAM lparam,
                     BOOL& handled) {  // NO_LINT
     if (worker_thread_.message_loop()) {
       worker_thread_.message_loop()->PostTask(
           FROM_HERE, NewRunnableMethod(this, &Base::OnWorkerStop));
       if (automation_client_.get())
-        automation_client_->CleanupAsyncRequests();
+        automation_client_->CleanupRequests();
       worker_thread_.Stop();
     }
     return 0;
   }
 
   // ChromeFrameDelegate override
   virtual void OnAutomationServerReady() {
     ChromeFramePlugin<T>::OnAutomationServerReady();
 
     ready_state_ = READYSTATE_COMPLETE;
@@ skipping 484 matching lines @@
   EventHandlers onprivatemessage_;
   EventHandlers onextensionready_;
 
   // The UrlmonUrlRequest instance instantiated for downloading the base URL.
   scoped_refptr<CComObject<UrlmonUrlRequest> > base_url_request_;
 
   base::Thread worker_thread_;
 };
 
 #endif  // CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_