For PR_Malloc(), nspr_use_zone_allocator is read, after s/PRBool/bool, the value becomes a random int, and zone allocator is used. It crashed when moz_free() is used to free the buffer.
Created attachment 568901 [details] [diff] [review] patch
Besides changing it back to PRBool, I wonder if it is right to use PR_Malloc() in nsSaveAsCharset::DoCharsetConversion().
Comment on attachment 568901 [details] [diff] [review] patch The patch is definitely right. NSPR types need to be used for NSPR symbols. (I don't know about comment 2.)