The implementation of HashMap for integer keys uses values 0 and -1 as special empty and deleted bins. However, a plug-in can call NPN_GetIntIdentifier for integers 0 or -1. I'm currently working around this by remapping the incoming int32 space to uint64 with bit 32 set, which messily avoids 0 or -1. This causes any plug-in which tries to get an NPIdentifier from Javascript to fail an assertion check.
Which revision are you seeing this problem in? The problem you describe sounds like one which was fixed with <http://trac.webkit.org/projects/webkit/changeset/28366>.
Sorry - somehow I missed that. The tree I'm working off is mostly 523.x and doesn't have this fix. The trunk version of npruntime.cpp can be taken in isolation, so I'll just grab that.
Closing as WFM as this is fixed in HEAD.