It's currently #6 top crasher in the first build of 13.0a1. The regression range is: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=3f26b7bee352&tochange=e18c7bc2c28e It's likely caused by bug 90268. Signature mozalloc_abort(char const* const) | NS_DebugBreak_P | mozilla::plugins::PPluginInstanceParent::OnChannelClose() More Reports Search UUID bb09ea28-2255-40fd-a9ea-8653e2120201 Date Processed 2012-02-01 20:30:53 Uptime 927 Last Crash 15.5 minutes before submission Install Age 1.3 hours since version was first installed. Install Time 2012-02-01 19:08:00 Product Firefox Version 13.0a1 Build ID 20120201031146 Release Channel nightly OS Windows NT OS Version 5.1.2600 Service Pack 3 Build Architecture x86 Build Architecture Info GenuineIntel family 15 model 6 stepping 5 Crash Reason EXCEPTION_BREAKPOINT Crash Address 0xac195f App Notes AdapterVendorID: 0x1002, AdapterDeviceID: 0x9598, AdapterSubsysID: 00000000, AdapterDriverVersion: 8.911.0.0 D3D10 Layers? D3D10 Layers- D3D9 Layers? D3D9 Layers+ xpcom_runtime_abort(###!!! ABORT: `OnClose' called on non-toplevel actor: file e:/builds/moz2_slave/m-cen-w32-ntly/build/obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp, line 2376) EMCheckCompatibility True Frame Module Signature [Expand] Source 0 mozalloc.dll mozalloc_abort memory/mozalloc/mozalloc_abort.cpp:79 1 xul.dll NS_DebugBreak_P xpcom/base/nsDebugImpl.cpp:375 2 xul.dll mozilla::plugins::PPluginInstanceParent::OnChannelClose obj-firefox/ipc/ipdl/PPluginInstanceParent.cpp:2376 3 xul.dll nsCOMPtr_base::assign_with_AddRef obj-firefox/xpcom/build/nsCOMPtr.cpp:88 4 xul.dll nsPluginStreamListenerPeer::InitializeEmbedded dom/plugins/base/nsPluginStreamListenerPeer.cpp:405 5 xul.dll nsPluginHost::NewEmbeddedPluginStreamListener dom/plugins/base/nsPluginHost.cpp:3323 6 xul.dll nsPluginHost::NewEmbeddedPluginStream dom/plugins/base/nsPluginHost.cpp:3342 7 xul.dll nsPluginHost::InstantiateEmbeddedPlugin dom/plugins/base/nsPluginHost.cpp:1107 8 xul.dll nsObjectLoadingContent::InstantiatePluginInstance content/base/src/nsObjectLoadingContent.cpp:637 More reports at: https://crash-stats.mozilla.com/report/list?signature=mozalloc_abort%28char%20const*%20const%29%20|%20NS_DebugBreak_P%20|%20mozilla%3A%3Aplugins%3A%3APPluginInstanceParent%3A%3AOnChannelClose%28%29

Benjamin, any chance you can look into this? I'm working on another regression, hoping to fix these quickly to avoid a backout.

I'm assuming nobody has STR?

The real call stack appears to be: eventloop -> nsAsyncInstantiateEvent::Run -> nsObjectLoadingContent::SyncStartPluginInstance -> nsObjectLoadingContent::InstantiatePluginInstance -> nsPluginHost::InstantiateEmbeddedPlugin -> nsPluginHost::NewEmbeddedPluginStream -> nsPluginHost::NewEmbeddedPluginStreamListener -> nsPluginStreamListenerPeer::InitializeEmbedded By the time we get here, however, the nsNPAPIPluginInstance appears to be dead memory. I wonder if there's a refcounting error somewhere? That might also explain bug 723473, which also looks like we're operating on dead memory.

This seems like it is gone.