Prevent |ChildAsyncCallback|s from touching freed |PluginInstanceChild|s if NPP_Destroy() re-enters or races with the callback. r=bsmedberg

dom/plugins/ChildAsyncCall.cpp

@@ -64,8 +64,8 @@ NS_IMETHODIMP
 ChildAsyncCall::Run()
 {
   if (mFunc) {
-    mFunc(mData);
     mInstance->mPendingAsyncCalls.RemoveElement(this);
+    mFunc(mData);
   }
   return NS_OK;
 }