A number of poorly written IE BHO's crash IE if ChromeFrame is the currently loaded document.

This is because they expect ChromeFrame to implement interfaces like IHTMLDocument2 on the same
lines as regular IE documents. Currently in ChromeFrame we patch the invoke methods of these
BHO's prior to firing navigation events from ChromeFrame. However this is not enough as
these objects also crash for regular navigation events fired from IE when ChromeFrame is loaded.

We now don't fire navigation events for buggy BHO's if ChromeFrame is the current document.
The BuggyBho handler instance is now created once for the thread. We patch when we receive
navigation notifications from Chrome as before. When we receive a notification
on our patched event sink we check if CF is loaded and if yes skip the call. 

Added helpers to chrome frame utils to check if CF is loaded in the current web browser instance.

BUG=55932
TEST=none

Review URL: http://codereview.chromium.org/6493002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@74691 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 25 insertions, 20 deletions

diff --git a/chrome_frame/buggy_bho_handling.h b/chrome_frame/buggy_bho_handling.h
index 4f1e7f5..83c635a 100644
--- a/chrome_frame/buggy_bho_handling.h
+++ b/chrome_frame/buggy_bho_handling.h
@@ -12,6 +12,7 @@
 #include <vector>
 
 #include "base/threading/thread_local.h"
+#include "base/win/scoped_comptr.h"
 
 namespace buggy_bho {
 
@@ -21,23 +22,32 @@ typedef HRESULT (__stdcall* InvokeFunc)(IDispatch* me, DISPID dispid,
                                         DISPPARAMS* params, VARIANT* result,
                                         EXCEPINFO* ei, UINT* err);
 
-// Construct an instance of this class on the stack when firing web browser
+// Construct a per thread instance of this class before firing web browser
 // events that can be sent to buggy BHOs.  This class will intercept those
 // BHOs (see list in cc file) and ignore notifications to those components
-// for as long as the BuggyBhoTls instance on the stack lives.
+// as long as ChromeFrame is the active view.
 class BuggyBhoTls {
  public:
-  BuggyBhoTls();
-  ~BuggyBhoTls();
-
-  // Call after instantiating an instance of BuggyBhoTls.  This method traverses
-  // the list of DWebBrowserEvents and DWebBrowserEvents2 subscribers and checks
-  // if any of the sinks belong to a list of known-to-be-buggy BHOs.
+  // This method traverses the list of DWebBrowserEvents and DWebBrowserEvents2
+  // subscribers and checks if any of the sinks belong to a list of
+  // known-to-be-buggy BHOs.
   // For each of those, a patch will be applied that temporarily ignores certain
   // invokes.
-  static HRESULT PatchBuggyBHOs(IWebBrowser2* browser);
+  HRESULT PatchBuggyBHOs(IWebBrowser2* browser);
+
+  // Returns the instance of the BuggyBhoTls object for the current thread.
+  static BuggyBhoTls* GetInstance();
+
+  // Destroys the BuggyBhoTls instance foe the current thread.
+  static void DestroyInstance();
+
+  void set_web_browser(IWebBrowser2* web_browser2) {
+    web_browser2_ = web_browser2;
+  }
 
  protected:
+  BuggyBhoTls();
+  ~BuggyBhoTls();
   // internal implementation:
 
   // Called when a buggy instance is found to be subscribing to browser events.
@@ -48,15 +58,12 @@ class BuggyBhoTls {
   // object running on the same thread (e.g. IE6) with one running CF and the
   // other MSHTML.  We don't want to drop events being fired by MSHTML, only
   // events fired by CF since these BHOs should handle MSHTML correctly.
-  bool IsBuggyObject(IDispatch* obj) const;
+  bool ShouldSkipInvoke(IDispatch* obj) const;
 
   // Static, protected member methods
 
-  // Returns the currently registered (TLS) BuggyBhoTls instance or NULL.
-  static BuggyBhoTls* FromCurrentThread();
-
   // Patches a subscriber if it belongs to a buggy dll.
-  static bool PatchIfBuggy(CONNECTDATA* cd, const IID& diid);
+  bool PatchIfBuggy(IUnknown* unk, const IID& diid);
 
   // Patches the IDispatch::Invoke method.
   static HRESULT PatchInvokeMethod(PROC* invoke);
@@ -71,14 +78,12 @@ class BuggyBhoTls {
  protected:
   // List of buggy subscribers.
   std::vector<IDispatch*> bad_objects_;
-
-  // Pointer to a previous instance of BuggyBhoTls on this thread if any.
-  // Under regular circumstances, this will be NULL.  However, there's a chance
-  // that we could get reentrant calls, hence we maintain a stack.
-  BuggyBhoTls* previous_instance_;
-
   // Where we store the current thread's instance.
   static base::ThreadLocalPointer<BuggyBhoTls> s_bad_object_tls_;
+  // The IWebBrowser2 instance for this thread.
+  base::win::ScopedComPtr<IWebBrowser2> web_browser2_;
+  // Set to true when we are done patching the event sinks of buggy bho's.
+  bool patched_;
 };
 
 }  // end namespace buggy_bho