Compliments of Purify (and lots of them): [E] FMM: Freeing mismatched memory in delete(void *) {11 occurrences} Address 0x0529dfc0 points into a committed VirtualAlloc'd block Location of free attempt delete(void *) [msvcrt.dll] nsPluginTag::~nsPluginTag(void) [nsPluginHostImpl.cpp:152] NS_IF_RELEASE(mEntryPoint); if (nsnull != mName) { => delete[] (mName); mName = nsnull; } nsPluginHostImpl::~nsPluginHostImpl(void) [nsPluginHostImpl.obj:1022] nsPluginHostImpl::`vector deleting destructor'(UINT) [nsPluginHostImpl.obj] nsPluginHostImpl::Release(void) [nsPluginHostImpl.obj:1028] nsServiceManagerImpl::ReleaseService(nsID const&,nsISupports *,nsIShutdownListener *) [nsServiceManager.cpp:343] nsServiceManager::ReleaseService(nsID const&,nsISupports *,nsIShutdownListener *) [nsServiceManager.cpp:509] nsWebShell::~nsWebShell(void) [nsWebShell.cpp:660] nsWebShell::`vector deleting destructor'(UINT) [GKWEB.dll] nsWebShell::Release(void) [nsWebShell.cpp:717] Allocation location VirtualAlloc [KERNEL32.dll] set_sbh_threshold [msvcrt.dll] set_sbh_threshold [msvcrt.dll] exception::what(void)const [msvcrt.dll] malloc [msvcrt.dll] new(UINT) [msvcrt.dll] nsISO88591ToUnicode::CreateInstance(nsISupports * *) [nsISO88591ToUnicode.cpp:47] } nsresult nsISO88591ToUnicode::CreateInstance(nsISupports ** aResult) => { *aResult = new nsISO88591ToUnicode(); return (*aResult == NULL)? NS_ERROR_OUT_OF_MEMORY : NS_OK; } nsConverterFactory::CreateInstance(nsISupports *,nsID const&,void * *) [nsUCvLatinModule.cpp:924] nsComponentManagerImpl::CreateInstance(nsID const&,nsISupports *,nsID const&,void * *) [nsComponentManager.cpp:1267] nsComponentManagerImpl::CreateInstanceByProgID(char const*,nsISupports *,nsID const&,void * *) [nsComponentManager.cpp:1298]

I also found it with Purify and fixed some time ago.

marking verified