Fix a crasher observed in ChromeFrame stable build 7.0.517.43. Crash occurs when we

attempt to terminate the urlmon transaction with a spurious BindToObject call which
is supposed to fail but release the transaction. While this works mostly it causes
a crash in urlmon at times on IE7.

To workaround this we now save away the IInternetProtocol interface which represents
the transaction object in our bind context info structure which is maintained per bind
context and terminate the protocol when we want the transaction to be destroyed.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=60370

Bug=60370

Review URL: http://codereview.chromium.org/3984006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63769 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 12 insertions, 0 deletions

diff --git a/chrome_frame/protocol_sink_wrap.cc b/chrome_frame/protocol_sink_wrap.cc
index bb47a5d..f2b85e4 100644
--- a/chrome_frame/protocol_sink_wrap.cc
+++ b/chrome_frame/protocol_sink_wrap.cc
@@ -701,6 +701,12 @@ STDMETHODIMP Hook_Start(InternetProtocol_Start_Fn orig_start,
   }
 
   if (IsCFRequest(bind_ctx)) {
+    ScopedComPtr<BindContextInfo> info;
+    BindContextInfo::FromBindContext(bind_ctx, info.Receive());
+    DCHECK(info);
+    if (info) {
+      info->set_protocol(protocol);
+    }
     return ForwardHookStart(orig_start, protocol, url, prot_sink, bind_info,
                             flags, reserved);
   }
@@ -776,6 +782,12 @@ STDMETHODIMP Hook_StartEx(InternetProtocol_StartEx_Fn orig_start_ex,
   }
 
   if (IsCFRequest(bind_ctx)) {
+    ScopedComPtr<BindContextInfo> info;
+    BindContextInfo::FromBindContext(bind_ctx, info.Receive());
+    DCHECK(info);
+    if (info) {
+      info->set_protocol(protocol);
+    }
     return ForwardHookStartEx(orig_start_ex, protocol, uri, prot_sink,
                               bind_info, flags, reserved);
   }