Make sure we flush out content before we try to set up the plug-in, since

that's going to perform DOM access that can flush.  Bug 377070, r+sr=biesi

content/base/src/nsObjectLoadingContent.cpp

@@ -1294,20 +1294,34 @@ nsObjectLoadingContent::GetFrame()
     do_QueryInterface(NS_STATIC_CAST(nsIImageLoadingContent*, this));
   NS_ASSERTION(thisContent, "must be a content");
 
-  nsIDocument* doc = thisContent->GetCurrentDoc();
+  PRBool flushed = PR_FALSE;
-  if (!doc) {
+  nsIFrame* frame;
-    return nsnull; // No current doc -> no frame
+  do {
-  }
+    nsIDocument* doc = thisContent->GetCurrentDoc();
+    if (!doc) {
+      return nsnull; // No current doc -> no frame
+    }
 
-  nsIPresShell* shell = doc->GetPrimaryShell();
+    nsIPresShell* shell = doc->GetPrimaryShell();
-  if (!shell) {
+    if (!shell) {
-    return nsnull; // No presentation -> no frame
+      return nsnull; // No presentation -> no frame
-  }
+    }
 
-  nsIFrame* frame = shell->GetPrimaryFrameFor(thisContent);
+    frame = shell->GetPrimaryFrameFor(thisContent);
-  if (!frame) {
+    if (!frame) {
-    return nsnull;
+      return nsnull;
-  }
+    }
+
+    if (flushed) {
+      break;
+    }
+    
+    // OK, let's flush out and try again.  Note that we want to reget
+    // the document, etc, since flushing might run script.
+    doc->FlushPendingNotifications(Flush_ContentAndNotify);
+
+    flushed = PR_TRUE;
+  } while (1);
 
   nsIObjectFrame* objFrame;
   CallQueryInterface(frame, &objFrame);