The ChromeFrameAutomationClient class needs to be refcounted as it implements the PluginRequestHandler

interface which is maintained by individual requests which can outlive the active document/activex instances.
I ran into a crash where UrlmonUrlRequest was calling into an invalid PluginRequestHandler pointer which
had been destroyed just before.

We also need to ensure that UrlmonUrlRequest and ChromeFrameActiveXBase select the multi threaded model as
AddRef/Release can be invoked from multiple threads.

I also removed the CleanupAsyncRequests function in ChromeFrameAutomationClient and moved all the code to CleanupRequests, which ensures that we treat synchronous
and asynchronous requests similarly. 

There are instances where an automation client instance is created and destroyed without being initialized which causes a spurious assert to fire in the Uninitialize function. I added a check in the Uninitialize function to return if the state is uninitialized.

Bug=none

Review URL: http://codereview.chromium.org/386014

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@31792 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 1 insertions, 1 deletions

diff --git a/chrome_frame/np_proxy_service.h b/chrome_frame/np_proxy_service.h
index c0a85c8..e41bda1 100644
--- a/chrome_frame/np_proxy_service.h
+++ b/chrome_frame/np_proxy_service.h
@@ -102,7 +102,7 @@ class NpProxyService : public NsISupportsImplBase<NpProxyService>,
   void Reset();
   DictionaryValue* BuildProxyValueSet();
 
-  ChromeFrameAutomationClient* automation_client_;
+  scoped_refptr<ChromeFrameAutomationClient> automation_client_;
 
   ScopedNsPtr<nsIServiceManager> service_manager_;
   ScopedNsPtr<nsIPrefService> pref_service_;