Fix bug 584512.

dom/base/nsGlobalWindow.cpp

@@ -9786,6 +9786,10 @@ nsNavigator::nsNavigator(nsIDocShell *aDocShell)
 
 nsNavigator::~nsNavigator()
 {
+  if (mMimeTypes)
+    mMimeTypes->Invalidate();
+  if (mPlugins)
+    mPlugins->Invalidate();
 }
 
 //*****************************************************************************
@@ -10210,8 +10214,15 @@ nsNavigator::LoadingNewDocument()
   // Release these so that they will be recreated for the
   // new document (if requested).  The plugins or mime types
   // arrays may have changed.  See bug 150087.
-  mMimeTypes = nsnull;
-  mPlugins = nsnull;
+  if (mMimeTypes) {
+    mMimeTypes->Invalidate();
+    mMimeTypes = nsnull;
+  }
+
+  if (mPlugins) {
+    mPlugins->Invalidate();
+    mPlugins = nsnull;
+  }
 
   if (mGeolocation)
   {

dom/base/nsMimeTypeArray.cpp

@@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -227,6 +228,10 @@ nsresult nsMimeTypeArray::GetMimeTypes()
   NS_PRECONDITION(!mInited && mPluginMimeTypeCount==0,
                       "already initialized");
 
+  if (!mNavigator) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
   nsIDOMPluginArray* pluginArray = nsnull;
   nsresult rv = mNavigator->GetPlugins(&pluginArray);
   if (rv == NS_OK) {

dom/base/nsMimeTypeArray.h

@@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -46,6 +47,8 @@
 
 class nsIDOMNavigator;
 
+// NB: Due to weak references, nsNavigator has intimate knowledge of our
+// members.
 class nsMimeTypeArray : public nsIDOMMimeTypeArray
 {
 public:
@@ -77,6 +80,13 @@ public:
     return static_cast<nsMimeTypeArray*>(aSupports);
   }
 
+  void Invalidate()
+  {
+    // NB: This will cause GetMimeTypes to fail from now on.
+    mNavigator = nsnull;
+    Clear();
+  }
+
 private:
   nsresult GetMimeTypes();
   void     Clear();

dom/base/nsPluginArray.cpp

@@ -189,11 +189,18 @@ nsPluginArray::GetPluginHost(nsIPluginHost** aPluginHost)
 }
 
 void
-nsPluginArray::SetDocShell(nsIDocShell* aDocShell)
+nsPluginArray::SetDocShell(nsIDocShell *aDocShell)
 {
   mDocShell = aDocShell;
 }
 
+void
+nsPluginArray::Invalidate()
+{
+  mDocShell = nsnull;
+  mNavigator = nsnull;
+}
+
 NS_IMETHODIMP
 nsPluginArray::Refresh(PRBool aReloadDocuments)
 {

dom/base/nsPluginArray.h

@@ -47,6 +47,8 @@ class nsNavigator;
 class nsIDocShell;
 class nsIPluginHost;
 
+// NB: Due to weak references, nsNavigator has intimate knowledge of our
+// internals.
 class nsPluginArray : public nsIDOMPluginArray
 {
 public:
@@ -85,7 +87,8 @@ private:
   PRBool AllowPlugins();
 
 public:
-  void SetDocShell(nsIDocShell* aDocShell);
+  void SetDocShell(nsIDocShell *aDocShell);
+  void Invalidate();
 
 protected:
   nsNavigator* mNavigator;