win95, laptop, ~ 35mb available on disk. several attempts at running xpviewer on a 30 sec. cycle got crashes on the first or second page load.

running viewer also seems to have same problem. running the viewer | file | top 100 sites seems to work ok, but when hitting the grok page with the "refresh the table" code it seems to be choking as well

This seems to have something to do with destroying the document. I bet Rick Potts knows what's going on here - he's a whiz in this area (adding to cc list) Setting severity to reflect the crashing nature of this bug. It's also a test stopper; upping priority. Here's my stack trace on this problem: nsHTMLDocument::~nsHTMLDocument() line 376 + 21 bytes nsHTMLDocument::`scalar deleting destructor'(unsigned int 1) + 15 bytes nsDocument::Release(nsDocument * const 0x013e8f00) line 264 + 102 bytes nsHTMLDocument::Release(nsHTMLDocument * const 0x013e8f00) line 423 PresShell::~PresShell() line 357 + 18 bytes PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes PresShell::Release(PresShell * const 0x013e09e0) line 304 + 28 bytes DocumentViewerImpl::~DocumentViewerImpl() line 206 + 18 bytes DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x013e9820) line 148 + 99 bytes nsWebShell::SetContentViewer(nsWebShell * const 0x013eaba0, nsIContentViewer * 0x00000000) line 768 + 27 bytes nsWebShell::ReleaseChildren() line 418 nsWebShell::Embed(nsWebShell * const 0x00ecd180, nsIContentViewer * 0x016020c0, const char * 0x00000000, nsISupports * 0x00000000) line 545 nsDocumentBindInfo::OnStartBinding(nsDocumentBindInfo * const 0x01607120, nsIURL * 0x01604c50, const char * 0x016058d0) line 1338 + 36 bytes OnStartBindingProxyEvent::HandleEvent(OnStartBindingProxyEvent * const 0x01607430) line 456 StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x01607434) line 421 + 12 bytes PL_HandleEvent(PLEvent * 0x01607434) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00e85060) line 357 + 9 bytes _md_EventReceiverProc(HWND__ * 0x00190162, unsigned int 49342, unsigned int 0, long 15224928) line 675 + 9 bytes USER32! 77e71250() 00e85060()

Just checked the fix into nsHTMLDocument. The problem was in the reference counting of the mForms list.

verified fixed, nt 40, win95 build 98113011