Bug 1430586 - Make sure the NPObjectData map still exists before use. r=jimm

The shutdown path has a way to free the sObjectMap before all plugin references to it have been executed.  It does this by scheduling a DeferNPObjectReleaseRunnable, then shutting down the plugin with PluginInstanceChild::Destroy.  This patch keeps the runnable from failing in that case.

dom/plugins/ipc/PluginScriptableObjectChild.cpp

@@ -1273,6 +1273,11 @@ PluginScriptableObjectChild::UnregisterObject(NPObject* aObject)
 PluginScriptableObjectChild::GetInstanceForNPObject(NPObject* aObject)
 {
   AssertPluginThread();
+  if (!sObjectMap) {
+    // All PluginInstanceChilds have been destroyed
+    return nullptr;
+  }
+
   NPObjectData* d = sObjectMap->GetEntry(aObject);
   if (!d) {
     return nullptr;