[JAEGER] Bug 585801 trial fix: innerize object passed as scope chain for JS evaluation

--HG--
extra : rebase_source : df9b94f7718c1737834ca5516ab3b751d3d0ec65

modules/plugin/base/src/nsNPAPIPlugin.cpp

@@ -1572,6 +1572,8 @@ _evaluate(NPP npp, NPObject* npobj, NPString *script, NPVariant *result)
     return false;
   }
 
+  OBJ_TO_INNER_OBJECT(cx, obj);
+
   // Root obj and the rval (below).
   jsval vec[] = { OBJECT_TO_JSVAL(obj), JSVAL_NULL };
   js::AutoArrayRooter tvr(cx, NS_ARRAY_LENGTH(vec), vec);