[E] FMM: Freeing mismatched memory in delete(void *) {1 occurrence} Address 0x08fbe9b0 points into a HeapAlloc'd block in heap 0x037a0000 Location of free attempt delete(void *) [dbgdel.cpp:35] Area::ParseCoords(nsString const&) [nsImageMap.cpp:290] { char* cp = aSpec.ToNewCString(); mCoords = lo_parse_coord_list(cp, &mNumCoords); => delete[] cp; } void Area::ToHTML(nsString& aResult) nsImageMap::AddArea(nsIContent *) [nsImageMap.cpp:855] nsImageMap::UpdateAreas(void) [nsImageMap.cpp:802] nsImageMap::Init(nsIDOMHTMLMapElement *) [nsImageMap.cpp:740] nsImageFrame::GetImageMap(void) [nsImageFrame.cpp:579] nsImageFrame::GetCursor(nsIPresContext&,nsPoint&,int&) [nsImageFrame.cpp:807] nsEventStateManager::UpdateCursor(nsIPresContext&,nsPoint&,nsIFrame *,nsEventStatus&) [nsEventStateManager.cpp:603] nsEventStateManager::PreHandleEvent(nsIPresContext&,nsGUIEvent *,nsIFrame *,nsEventStatus&,nsIView *) [nsEventStateManager.cpp:164] PresShell::HandleEvent(nsIView *,nsGUIEvent *,nsEventStatus&) [nsPresShell.cpp:2188] Should not use []. -dave

I think this is yours. Please correct me if I'm mistaken.

Rick: This is in mozilla/layout/html/base/src. Maybe Kipp?

Thanks for the bug report; I fixed it slightly differently...

Since this is a code fix, I don't have the ability to verify this as a QA contact. Kipp, could you please mark this as fixed.

SPAM. HTML Element component deprecated, changing component to Layout. See bug 88132 for details.