The ChromeFrameAutomationClient class needs to be refcounted as it implements...

chrome_frame/chrome_frame_automation.cc

Index: chrome_frame/chrome_frame_automation.cc
===================================================================
--- chrome_frame/chrome_frame_automation.cc	(revision 31733)
+++ chrome_frame/chrome_frame_automation.cc	(working copy)
@@ -436,7 +436,6 @@
   chrome_frame_delegate_ = chrome_frame_delegate;
   incognito_ = incognito;
   ui_thread_id_ = PlatformThread::CurrentId();
-
 #ifndef NDEBUG
   // In debug mode give more time to work with a debugger.
   if (IsDebuggerPresent()) {
@@ -476,6 +475,11 @@
 void ChromeFrameAutomationClient::Uninitialize() {
   DLOG(INFO) << __FUNCTION__;
 
+  if (init_state_ == UNINITIALIZED) {
+    DLOG(WARNING) << __FUNCTION__ << ": Automation client not initialized";
+    return;
+  }
+
   init_state_ = UNINITIALIZING;
 
   // Called from client's FinalRelease() / destructor
@@ -633,14 +637,14 @@
   }
 
   void InstallExtensionComplete(AutomationMsg_ExtensionResponseValues res) {
-    client_->PostTask(FROM_HERE, NewRunnableMethod(client_,
+    client_->PostTask(FROM_HERE, NewRunnableMethod(client_.get(),
         &ChromeFrameAutomationClient::InstallExtensionComplete, crx_path_,
         user_data_, res));
     delete this;
   }
 
  private:
-  ChromeFrameAutomationClient* client_;
+  scoped_refptr<ChromeFrameAutomationClient> client_;
   FilePath crx_path_;
   void* user_data_;
 };
@@ -1072,21 +1076,7 @@
 
 void ChromeFrameAutomationClient::CleanupRequests() {
   DCHECK_EQ(PlatformThread::CurrentId(), ui_thread_id_);
-  while (request_map_.size()) {
-    PluginUrlRequest* request = request_map_.begin()->second;
-    if (request) {
-      int request_id = request->id();
-      request->Stop();
-    }
-  }
 
-  DCHECK(request_map_.empty());
-  request_map_.clear();
-}
-
-void ChromeFrameAutomationClient::CleanupAsyncRequests() {
-  DCHECK_EQ(PlatformThread::CurrentId(), ui_thread_id_);
-
   std::vector<scoped_refptr<PluginUrlRequest> > request_list;
   // We copy the pending requests into a temporary vector as the Stop
   // function in the request could also try to delete the request from
@@ -1119,7 +1109,7 @@
     return false;
   }
 
-  CleanupAsyncRequests();
+  CleanupRequests();
   chrome_frame_delegate_ = delegate;
   SetParentWindow(NULL);
   return true;