From f5b425c04f72b41ac1a2b8a39b0d0c58068d529e Mon Sep 17 00:00:00 2001
From: Ben Turner <bent.mozilla@gmail.com>
Date: Thu, 3 Dec 2009 11:53:09 -0800
Subject: [PATCH] Fix bad invalidation bug in child NPObjects

---
 dom/plugins/PluginScriptableObjectChild.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dom/plugins/PluginScriptableObjectChild.cpp b/dom/plugins/PluginScriptableObjectChild.cpp
index d67c3c14c4a5..385176996959 100644
--- a/dom/plugins/PluginScriptableObjectChild.cpp
+++ b/dom/plugins/PluginScriptableObjectChild.cpp
@@ -651,7 +651,11 @@ PluginScriptableObjectChild::~PluginScriptableObjectChild()
       }
     }
     else {
-      PluginModuleChild::sBrowserFuncs.releaseobject(mObject);
+      // Make sure we've invalidated our NPObject so that the plugin doesn't
+      // hold an object with a dangling pointer.
+
+      // Calling a virtual in the destructor, make sure we call the right one.
+      PluginScriptableObjectChild::AnswerInvalidate();
     }
   }
   NS_ASSERTION(!PluginModuleChild::current()->