Fixing bug 474866. Don't null out the peer when stopping plugins to break reference cycles, as cached plugins depend on the peer remaining set. Null out the owner instead. r=joshmoz@gmail.com, sr=bzbarsky@mit.edu

modules/plugin/base/src/nsNPAPIPluginInstance.cpp

@@ -841,8 +841,6 @@ NS_IMETHODIMP nsNPAPIPluginInstance::Stop(void)
   }
 
   if (!mStarted) {
-    // Break our cycle with the peer that owns us.
-    mPeer = nsnull;
     return NS_OK;
   }
 
@@ -861,8 +859,6 @@ NS_IMETHODIMP nsNPAPIPluginInstance::Stop(void)
   OnPluginDestroy(&fNPP);
 
   if (fCallbacks->destroy == NULL) {
-    // Break our cycle with the peer that owns us.
-    mPeer = nsnull;
     return NS_ERROR_FAILURE;
   }
 
@@ -890,9 +886,6 @@ NS_IMETHODIMP nsNPAPIPluginInstance::Stop(void)
 
   nsJSNPRuntime::OnPluginDestroy(&fNPP);
 
-  // Break our cycle with the peer that owns us.
-  mPeer = nsnull;
-
   if (error != NPERR_NO_ERROR)
     return NS_ERROR_FAILURE;
   else

modules/plugin/base/src/nsPluginHostImpl.cpp

@@ -5909,6 +5909,16 @@ nsPluginHostImpl::StopPluginInstance(nsIPluginInstance* aInstance)
       }
     }
   }
+
+  nsCOMPtr<nsIPluginInstancePeer> peer;
+  aInstance->GetPeer(getter_AddRefs(peer));
+
+  if (peer) {
+    // Break the reference cycle between the instance, peer, and
+    // owner.
+    ((nsPluginInstancePeerImpl*)peer.get())->SetOwner(nsnull);
+  }
+
   return NS_OK;
 }