Bug 635191: If the object frame has gone away, there's no way to determine IsUpToDate(), so just dispatch the paint-finished event. r=roc a=b

layout/generic/nsObjectFrame.cpp

@@ -3458,7 +3458,9 @@ NS_IMETHODIMP nsPluginInstanceOwner::GetDocument(nsIDocument* *aDocument)
 
 NS_IMETHODIMP nsPluginInstanceOwner::InvalidateRect(NPRect *invalidRect)
 {
-  if (mWaitingForPaint && IsUpToDate()) {
+  // If our object frame has gone away, we won't be able to determine
+  // up-to-date-ness, so just fire off the event.
+  if (mWaitingForPaint && (!mObjectFrame || IsUpToDate())) {
     // We don't care when the event is dispatched as long as it's "soon",
     // since whoever needs it will be wwaiting for it
     nsCOMPtr<nsIRunnable> event = new AsyncPaintWaitEvent(mContent, PR_TRUE);