Here is the Stack trace ns4xPlugin::_memalloc(unsigned long 30) line 810 + 10 bytes NPCOSMOP! 024b42a0() NPCOSMOP! 024b3749() ns4xPluginInstance::Initialize(ns4xPluginInstance * const 0x0128b380, nsIPluginInstancePeer * 0x0128cb30) line 373 + 40 bytes nsPluginHostImpl::SetUpPluginInstance(nsPluginHostImpl * const 0x011f0bf4, char * 0x0125fb10, nsIURL * 0x00000000, nsIPluginInstanceOwner * 0x0125f990) line 1807 nsPluginHostImpl::InstantiateEmbededPlugin(nsPluginHostImpl * const 0x011f0bf4, char * 0x0125fb10, nsString & {"models/spin_humerus.wrl"}, nsIPluginInstanceOwner * 0x0125f990) line 1521 + 22 bytes nsObjectFrame::Reflow(nsObjectFrame * const 0x0125f914, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 5331072) line 692 + 39 bytes nsBlockFrame::ReflowFloater(nsIPresContext & {...}, nsBlockReflowState & {...}, nsIFrame * 0x0125f910, nsHTMLReflowState & {...}) line 3954 nsBlockReflowState::AddFloater(nsPlaceholderFrame * 0x0125fa20, int 1) line 4003 nsBlockReflowState::InitFloater(nsPlaceholderFrame * 0x0125fa20) line 3968 nsLineLayout::InitFloater(nsPlaceholderFrame * 0x0125fa20) line 258 nsPlaceholderFrame::Reflow(nsPlaceholderFrame * const 0x0125fa24, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 52 nsInlineReflow::ReflowFrame(int 0, nsHTMLReflowMetrics & {...}, unsigned int & 0) line 450 nsInlineReflow::ReflowFrame(nsIFrame * 0x0125fa20, int 0, unsigned int & 0) line 274 + 20 bytes nsBlockFrame::ReflowInlineFrame(nsBlockReflowState & {...}, nsLineBox * 0x01257aa0, nsIFrame * 0x0125fa20, int * 0x0012dcd0) line 2518 + 31 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01257aa0, int * 0x0012dd34) line 1697 + 24 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1452 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01258bb4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 2013512672) line 933 + 18 bytes nsBlockReflowContext::ReflowBlock(nsIFrame * 0x01258bb0, const nsRect & {...}, int 1, nsMargin & {...}, unsigned int & 2013512672) line 192 + 39 bytes nsBlockFrame::ReflowBlockFrame(nsBlockReflowState & {...}, nsLineBox * 0x01258dd0, int * 0x0012eb70) line 2328 + 45 bytes nsBlockFrame::ReflowLine(nsBlockReflowState & {...}, nsLineBox * 0x01258dd0, int * 0x0012eb70) line 1663 + 20 bytes nsBlockFrame::ReflowDirtyLines(nsBlockReflowState & {...}) line 1452 + 20 bytes nsBlockFrame::Reflow(nsBlockFrame * const 0x01258694, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 933 + 18 bytes nsAreaFrame::Reflow(nsAreaFrame * const 0x01258694, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 509 + 25 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x01258690, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes RootFrame::Reflow(RootFrame * const 0x012583f4, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 256 nsContainerFrame::ReflowChild(nsIFrame * 0x012583f0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes nsScrollFrame::Reflow(nsScrollFrame * const 0x01257e14, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 352 nsContainerFrame::ReflowChild(nsIFrame * 0x01257e10, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 364 + 28 bytes ViewportFrame::Reflow(ViewportFrame * const 0x01257c34, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 438 nsHTMLReflowCommand::Dispatch(nsHTMLReflowCommand * const 0x0125fed0, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsSize & {...}, nsIRenderingContext & {...}) line 168 PresShell::ProcessReflowCommands(PresShell * const 0x01255800) line 1178 PresShell::ExitReflowLock(PresShell * const 0x01255800) line 624 PresShell::ContentAppended(PresShell * const 0x01255808, nsIDocument * 0x0120bb70, nsIContent * 0x0125767c, int 5) line 1591 nsDocument::ContentAppended(nsDocument * const 0x0120bb70, nsIContent * 0x0125767c, int 5) line 1236 nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x0120bb70, nsIContent * 0x0125767c, int 5) line 684 HTMLContentSink::DidBuildModel(HTMLContentSink * const 0x0120c6a0, int 0) line 1480 CNavDTD::DidBuildModel(CNavDTD * const 0x01255e60, unsigned int 0, int 1, nsIParser * 0x0120b900, nsIContentSink * 0x0120c6a0) line 563 + 22 bytes nsParser::DidBuildModel(unsigned int 0) line 434 + 55 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 665 nsParser::OnStopBinding(nsParser * const 0x0120b904, nsIURL * 0x011feb60, unsigned int 0, unsigned short * 0x0125d860) line 887 + 17 bytes nsDocumentBindInfo::OnStopBinding(nsDocumentBindInfo * const 0x011fe4d0, nsIURL * 0x011feb60, unsigned int 0, unsigned short * 0x0125d860) line 1717 + 30 bytes OnStopBindingProxyEvent::HandleEvent(OnStopBindingProxyEvent * const 0x0125d810) line 602 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x0125d814) line 482 + 12 bytes PL_HandleEvent(PLEvent * 0x0125d814) line 478 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x011ae7d0) line 439 + 9 bytes _md_EventReceiverProc(void * 0x015e0206, unsigned int 49392, unsigned int 0, long 18540496) line 822 + 9 bytes USER32! 77e71250()

this does not crash on win95, win98, linux or mac

setting Greg as QA contact, Greg can you check this out on apprunner and see if it crashes, if it doesn't, please resolve the bug.

works fine in March 10 and 11 builds on all platforms. Verified as WFM.

this sounds like heap corruption...