click on any video link on this page A javascript window with 'yahoo media player help' should come up. LEt it go thru all detection and everything, be sure to choose realplayer (if it does not come up selected by default). Observe the browser crash while running the realplayer test inside the same window stack: Call Stack: (Signature = nsPluginInstanceOwner::GetInstance 16686d73) nsPluginInstanceOwner::GetInstance [d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 1874] nsObjectFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 458] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 116] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 119] nsObjectFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsObjectFrame.cpp, line 483] nsLineBox::DeleteLineList [d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 252] nsBlockFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 315] nsLineBox::DeleteLineList [d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 252] nsBlockFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 315] nsLineBox::DeleteLineList [d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 252] nsBlockFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 315] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 116] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 119] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 116] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 119] nsBoxFrame::Destroy [d:\builds\seamonkey\mozilla\layout\xul\base\src\nsBoxFrame.cpp, line 1009] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 116] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 119] ViewportFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsViewportFrame.cpp, line 142] FrameManager::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 454] PresShell::~PresShell [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1491] PresShell::`scalar deleting destructor' PresShell::Release [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 1378] nsCOMPtr_base::~nsCOMPtr_base [d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 50] DocumentViewerImpl::~DocumentViewerImpl [d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 876] DocumentViewerImpl::Release [d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 831] nsCOMPtr_base::assign_with_AddRef [d:\builds\seamonkey\mozilla\xpcom\base\nsCOMPtr.cpp, line 59] PresShell::UnsuppressAndInvalidate [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4483] PresShell::UnsuppressAndInvalidate [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4483] PresShell::UnsuppressPainting [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 4511] DocumentViewerImpl::LoadComplete [d:\builds\seamonkey\mozilla\content\base\src\nsDocumentViewer.cpp, line 1119] nsDocShell::EndPageLoad [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3630] nsWebShell::EndPageLoad [d:\builds\seamonkey\mozilla\docshell\base\nsWebShell.cpp, line 902] nsDocShell::OnStateChange [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 3551] nsDocLoaderImpl::FireOnStateChange [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 1096] nsDocLoaderImpl::doStopDocumentLoad [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 735] nsDocLoaderImpl::DocLoaderIsEmpty [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 633] nsDocLoaderImpl::OnStopRequest [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 564] nsLoadGroup::RemoveRequest [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 517] nsLoadGroup::Cancel [d:\builds\seamonkey\mozilla\netwerk\base\src\nsLoadGroup.cpp, line 239] nsDocLoaderImpl::Stop [d:\builds\seamonkey\mozilla\uriloader\base\nsDocLoader.cpp, line 281] nsURILoader::Stop [d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 538] nsDocShell::StopLoad [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 671] nsDocShell::InternalLoad [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 4263] nsDocShell::LoadHistoryEntry [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 5357] nsDocShell::Reload [d:\builds\seamonkey\mozilla\docshell\base\nsDocShell.cpp, line 2181] PluginArrayImpl::Refresh [d:\builds\seamonkey\mozilla\dom\src\base\nsPluginArray.cpp, line 198] PluginArrayImpl::Refresh [d:\builds\seamonkey\mozilla\dom\src\base\nsPluginArray.cpp, line 239] XPTC_InvokeByIndex [d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, line 139] XPCWrappedNative::CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednative.cpp, line 1837] XPC_WN_CallMethod [d:\builds\seamonkey\mozilla\js\src\xpconnect\src\xpcwrappednativejsops.cpp, line 1242] js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 809] js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2703] js_Execute [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 988] JS_EvaluateUCScriptForPrincipals [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 3275] nsJSContext::EvaluateString [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 604] nsScriptLoader::EvaluateScript [d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 565] nsScriptLoader::ProcessRequest [d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 478] nsScriptLoader::ProcessScriptElement [d:\builds\seamonkey\mozilla\content\base\src\nsScriptLoader.cpp, line 422] nsHTMLScriptElement::SetDocument [d:\builds\seamonkey\mozilla\content\html\content\src\nsHTMLScriptElement.cpp, line 146] nsGenericHTMLContainerElement::AppendChildTo [d:\builds\seamonkey\mozilla\content\html\content\src\nsGenericHTMLElement.cpp, line 3655] HTMLContentSink::ProcessSCRIPTTag [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 4611] HTMLContentSink::AddLeaf [d:\builds\seamonkey\mozilla\content\html\document\src\nsHTMLContentSink.cpp, line 3173] CNavDTD::AddLeaf [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 3767]

Correcting typo in summary.

Confirming and accpeting...this bad an needs to be fixed for mozilla 0.9.2 The problem here is that in nsObjectFrame::Destroy, mInstanceOwner has a refcount of 4 but it's instance is blown away. The vtable is bad. Need to figure out some way to be sure we have a valid instance in the owner.

*** This bug has been marked as a duplicate of 80105 ***

yeah, dup