Bug 434163. Make sure to not let our hashtable mutate while we're iterating it. r+sr=jst

modules/plugin/base/src/nsJSNPRuntime.cpp

@@ -1800,6 +1800,11 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
   NppAndCx *nppcx = reinterpret_cast<NppAndCx *>(arg);
 
   if (entry->mNpp == nppcx->npp) {
+    // Prevent invalidate() and deallocate() from touching the hash
+    // we're enumerating.
+    const PLDHashTableOps *ops = table->ops;
+    table->ops = nsnull;
+
     NPObject *npobj = entry->mNPObj;
 
     if (npobj->_class && npobj->_class->invalidate) {
@@ -1816,6 +1821,8 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 
     ::JS_SetPrivate(nppcx->cx, entry->mJSObj, nsnull);
 
+    table->ops = ops;    
+
     return PL_DHASH_REMOVE;
   }