Bug 637004 (and maybe bug 637282): Guard against attempting to paint after NPP_Destroy. r=bsmedberg,karlt a=a

dom/plugins/PluginInstanceChild.cpp

@@ -3421,6 +3421,13 @@ PluginInstanceChild::AnswerNPP_Destroy(NPError* aResult)
         static_cast<BrowserStreamChild*>(streams[i])->FinishDelivery();
 
     mTimers.Clear();
+
+    // NPP_Destroy() should be a synchronization point for plugin threads
+    // calling NPN_AsyncCall: after this function returns, they are no longer
+    // allowed to make async calls on this instance.
+    PluginModuleChild::current()->NPP_Destroy(this);
+    mData.ndata = 0;
+
     if (mCurrentInvalidateTask) {
         mCurrentInvalidateTask->Cancel();
         mCurrentInvalidateTask = nsnull;
@@ -3430,12 +3437,6 @@ PluginInstanceChild::AnswerNPP_Destroy(NPError* aResult)
         mCurrentAsyncSetWindowTask = nsnull;
     }
 
-    // NPP_Destroy() should be a synchronization point for plugin threads
-    // calling NPN_AsyncCall: after this function returns, they are no longer
-    // allowed to make async calls on this instance.
-    PluginModuleChild::current()->NPP_Destroy(this);
-    mData.ndata = 0;
-
     ClearAllSurfaces();
 
     mDeletingHash = new nsTHashtable<DeletingObjectEntry>;