Bug 300572 FF11a2 Crash in [@ js_SetSlotThreadSafe] with new Shockwave Flash beta 8.0 b434

r=jst sr=jst a=shaver

layout/base/nsPresShell.cpp

@@ -6557,8 +6557,8 @@ StopPluginInstance(PresShell *aShell, nsIContent *aContent)
     instance->Destroy();
     instance->SetWindow(nsnull);
   } else {
-    instance->SetWindow(nsnull);
     instance->Stop();
+    instance->SetWindow(nsnull);
     instance->Destroy();
   }
 

modules/plugin/base/src/nsJSNPRuntime.cpp

@@ -1345,7 +1345,11 @@ NPObjWrapperPluginDestroyedCallback(PLDHashTable *table, PLDHashEntryHdr *hdr,
 
     JSContext *cx = GetJSContext((NPP)arg);
 
-    ::JS_SetPrivate(cx, entry->mJSObj, nsnull);
+    if (cx) {
+      ::JS_SetPrivate(cx, entry->mJSObj, nsnull);
+    } else {
+      NS_ERROR("dangling entry->mJSObj JSPrivate because we can't find cx");
+    }
 
     return PL_DHASH_REMOVE;
   }