Fix crash bug 316012, r=biesi, sr=jst

git-svn-id: svn://10.0.0.236/trunk@185745 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/layout/generic/nsObjectFrame.cpp

@@ -2796,6 +2796,10 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
 
   nsINodeInfo *ni = content->NodeInfo();
 
+  // Making DOM method calls can cause our frame to go away, which
+  // might kill us...
+  nsCOMPtr<nsIPluginInstanceOwner> kungFuDeathGrip(this);
+  
   if (ni->NamespaceEquals(kNameSpaceID_XHTML)) {
     // For XHTML elements we need to take the namespace URI into
     // account when looking for param elements.
@@ -2862,6 +2866,9 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
     }
   }
 
+  // We're done with DOM method calls now; make sure we still have a frame.
+  NS_ENSURE_TRUE(mOwner, NS_ERROR_OUT_OF_MEMORY);
+
   PRUint32 cparams;
   ourParams->Count(&cparams); // unsigned 32 bits to unsigned 16 bits conversion
   if (cparams < 0x0000FFFF)