Load any of the bookmarks that redirect (as above) and it will crash down destroying the content sink. it appears as if the stack (mStack) it's trying to delete in the content sink has already been deleted. PowerPC access exception at 0E26F2C8 nsMemAllocator::GetAllocatorFromBlock(void* )+00028 Calling chain using A6/R1 links Back chain ISA Caller 00000000 PPC 06BBEAA4 077962C0 PPC 06BBA368 main+0013C 07796240 PPC 06BB8DC8 main1(int, char**)+00550 07796170 PPC 0E002E78 nsAppShellService::Run()+00020 07796130 PPC 0DC85528 nsAppShell::Run()+00050 077960B0 PPC 0DC85E28 nsMacMessagePump::DoMessagePump()+00044 07796060 PPC 0DC86140 nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 00198 07796010 PPC 0E2D8CCC Repeater::DoRepeaters(const EventRecord&)+00034 07795FD0 PPC 0DC62000 nsMacNSPREventQueueHandler::RepeatAction(const EventRecord&)+000 2C 07795F90 PPC 0DDD5334 nsEventQueueServiceImpl::ProcessEvents()+00070 07795F40 PPC 0DDEF258 nsEventQueueImpl::ProcessPendingEvents()+00018 07795F00 PPC 0E1E5B00 PL_ProcessPendingEvents+0007C 07795EB0 PPC 0E1E5C30 PL_HandleEvent+0004C 07795E70 PPC 0DEC31F0 nsStreamListenerEvent::HandlePLEvent(PLEvent*)+00060 07795E20 PPC 0DEC3F40 nsOnStopRequestEvent::HandleEvent()+0007C 07795DD0 PPC 0D86C898 nsHTTPResponseListener::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const unsigned short*)+000C8 07795D80 PPC 0D866968 nsHTTPChannel::ResponseCompleted(nsIChannel*, unsigned int, cons t unsigned short*)+0009C 07795D10 PPC 0E16EFE4 nsChannelListener::OnStopRequest(nsIChannel*, nsISupports*, unsi gned int, const unsigned short*)+00050 07795CC0 PPC 0E16D520 nsDocumentBindInfo::OnStopRequest(nsIChannel*, nsISupports*, uns igned int, const unsigned short*)+001B0 07795C50 PPC 0E16D5C4 nsQueryInterface::nsQueryInterface(nsISupports*, unsigned int*)+ 03ADC 07795C10 PPC 0E16FEAC nsGetServiceByCID::nsGetServiceByCID(const nsID&, unsigned int*) +01158 07795BD0 PPC 0DA12B64 nsParser::Release()+0008C 07795B90 PPC 0DA12994 nsParser::~nsParser()+000B4 07795B50 PPC 0DA16ABC CParserContext::~CParserContext()+00088 07795B10 PPC 0DA02B34 CNavDTD::Release()+0008C 07795AD0 PPC 0DA03104 CNavDTD::~CNavDTD()+00120 07795A80 PPC 09AA8A78 HTMLContentSink::Release()+0008C 07795A40 PPC 09AA87E4 HTMLContentSink::~HTMLContentSink()+002B4 077959F0 PPC 09AA584C SinkContext::~SinkContext()+0009C 077959A0 PPC 0E26DE7C __dla__FPv+0001C 07795940 PPC 0E26DD48 operator delete(void*)+0001C 077958E0 PPC 0E26EEB0 free+00024 Closing log This happens on both mac and win32

18328 crahses with the same stack. Marking the bug duplicate. Unable to reproduce the crash for bug 18328 but luckily 19113 is reproduceable. So, before marking FIXED or VERIFIED please confirm it with both the bugs. *** This bug has been marked as a duplicate of 18328 ***

This bug deals with bookmarks file, dupe deals with bankofamerica page? I'm re-opening for someone to take another look.

Petersen -- is this bug still valid?

Marking PDT+, but please verify that this bug still exists.

Clearing DUPLICATE resolution due to reopen.

Changing Assign eng from leger.

this is fine with M12 build

marking Verified.