Fix JS_InstanceOf to work correctly again with a null obj, and to assert same-compartment only if called when an error might be reported. rs=luke

js/src/jsapi.cpp

@@ -2932,8 +2932,13 @@ JS_PUBLIC_API(JSBool)
 JS_InstanceOf(JSContext *cx, JSObject *obj, JSClass *clasp, jsval *argv)
 {
     CHECK_REQUEST(cx);
-    assertSameCompartment(cx, obj);
-    if (obj->getJSClass() != clasp) {
+#ifdef DEBUG
+    if (argv) {
+        assertSameCompartment(cx, obj);
+        assertSameCompartment(cx, JSValueArray(argv - 2, 2));
+    }
+#endif
+    if (!obj || obj->getJSClass() != clasp) {
         if (argv)
             ReportIncompatibleMethod(cx, Valueify(argv - 2), Valueify(clasp));
         return false;

modules/plugin/base/src/nsJSNPRuntime.cpp

@@ -2302,9 +2302,7 @@ static void
 NPObjectMember_Trace(JSTracer *trc, JSObject *obj)
 {
   NPObjectMemberPrivate *memberPrivate =
-    (NPObjectMemberPrivate *)::JS_GetInstancePrivate(trc->context, obj,
-                                                     &sNPObjectMemberClass,
-                                                     nsnull);
+    (NPObjectMemberPrivate *)::JS_GetPrivate(trc->context, obj);
   if (!memberPrivate)
     return;