Bug 898906. Fix this bug by making nsMimeType objects hold their active plugin alive, and rely on the cycle collector to break the explicit reference cycle. r=mccr8

---
 dom/base/crashtests/898906.html     | 14 ++++++++++++++
 dom/base/crashtests/crashtests.list |  3 ++-
 dom/base/nsMimeTypeArray.cpp        |  2 +-
 dom/base/nsMimeTypeArray.h          | 14 ++++++--------
 dom/base/nsPluginArray.cpp          | 24 +-----------------------
 dom/base/nsPluginArray.h            |  2 --
 6 files changed, 24 insertions(+), 35 deletions(-)
 create mode 100644 dom/base/crashtests/898906.html
Bug 865919 - Abort decode of INT32_MIN BMPs. r=joe
Bug 865919 - Add INT32_MIN-height BMP test. r=joe