Bug 791798 - topcrash in mozilla::plugins::parent::_releaseobject because of incremental GC: we're creating a new wrapper before teardown which races with the release event. r=bsmedberg

dom/plugins/base/nsJSNPRuntime.cpp

@@ -1951,6 +1951,10 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 
     table->ops = ops;    
 
+    if (sDelayedReleases && sDelayedReleases->RemoveElement(npobj)) {
+      OnWrapperDestroyed();
+    }
+
     return PL_DHASH_REMOVE;
   }