The ChromeFrameAutomationClient class needs to be refcounted as it implements...

chrome_frame/urlmon_url_request.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_FRAME_URLMON_URL_REQUEST_H_
 #define CHROME_FRAME_URLMON_URL_REQUEST_H_
 
 #include <urlmon.h>
 #include <atlbase.h>
 #include <atlcom.h>
 #include <atlwin.h>
 
 #include <algorithm>
 
 #include "base/lock.h"
 #include "base/platform_thread.h"
 #include "base/thread.h"
 #include "base/scoped_comptr_win.h"
 #include "chrome_frame/plugin_url_request.h"
 #include "chrome_frame/chrome_frame_delegate.h"
 
 #include "net/base/net_errors.h"
 #include "net/base/upload_data.h"
 
 class UrlmonUrlRequest
-    : public CComObjectRootEx<CComSingleThreadModel>,
+    : public CComObjectRootEx<CComMultiThreadModel>,
       public PluginUrlRequest,
       public IServiceProviderImpl<UrlmonUrlRequest>,
       public IBindStatusCallback,
       public IHttpNegotiate,
       public IAuthenticate,
       public IHttpSecurity,
       public CWindowImpl<UrlmonUrlRequest>,
       public TaskMarshallerThroughWindowsMessages<UrlmonUrlRequest> {
  public:
   typedef TaskMarshallerThroughWindowsMessages<UrlmonUrlRequest>
@@ skipping 216 matching lines @@
   URLRequestStatus status_;
 
   PlatformThreadId thread_;
   static int instance_count_;
   HWND parent_window_;
   DISALLOW_COPY_AND_ASSIGN(UrlmonUrlRequest);
 };
 
 #endif  // CHROME_FRAME_URLMON_URL_REQUEST_H_