in browser/base/content/sanitize.js and browser/components/privatebrowsing/src/nsPrivateBrowsingService.js, we have
let ph = Cc["@mozilla.org/plugin/host;1"].getService(Ci.nsIPluginHost);
which is just after QueryInterfaced to nsIPluginHost again.
Created attachment 554845 [details] [diff] [review]
patch proposal. I've tested it on try server:
Comment on attachment 554845 [details] [diff] [review]
I think this is ehsan's code.
Pushed to inbound.