Fix a crasher observed in ChromeFrame stable build 7.0.517.43. Crash occurs when we

attempt to terminate the urlmon transaction with a spurious BindToObject call which
is supposed to fail but release the transaction. While this works mostly it causes
a crash in urlmon at times on IE7.

To workaround this we now save away the IInternetProtocol interface which represents
the transaction object in our bind context info structure which is maintained per bind
context and terminate the protocol when we want the transaction to be destroyed.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=60370

Bug=60370

Review URL: http://codereview.chromium.org/3984006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63769 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 9 insertions, 0 deletions

diff --git a/chrome_frame/bind_context_info.h b/chrome_frame/bind_context_info.h
index 91ff5c3..d6c5d22 100644
--- a/chrome_frame/bind_context_info.h
+++ b/chrome_frame/bind_context_info.h
@@ -92,6 +92,14 @@ class __declspec(uuid("00000000-0000-0000-0000-000000000000")) BindContextInfo
     return prot_data_.get() != NULL;
   }
 
+  void set_protocol(IInternetProtocol* protocol) {
+    protocol_ = protocol;
+  }
+
+  IInternetProtocol* protocol() {
+    return protocol_.get();
+  }
+
  protected:
   STDMETHOD(GetCppObject)(void** me) {
     DCHECK(me);
@@ -110,6 +118,7 @@ class __declspec(uuid("00000000-0000-0000-0000-000000000000")) BindContextInfo
   std::wstring url_;
   base::win::ScopedComPtr<IUnknown> ftm_;
   scoped_refptr<ProtData> prot_data_;
+  ScopedComPtr<IInternetProtocol> protocol_;
 
   DISALLOW_COPY_AND_ASSIGN(BindContextInfo);
 };