When visiting the above URL I get the following crash: 0012fcb2() GKHTML! const StyleContextImpl::`vftable'{for `nsIMutableStyleContext'} address 0x017108b0 StyleContextImpl::AddRef(StyleContextImpl * const 0x0681681d) line 1659 (no more stack) The 'this' pointer in StyleContextImpl::AddRef looks bogus, which is presumably why we ended up with the PC in never-never land.

Tested using the following builds: Win: 1999120208 Mac: 1999120208 Linux: 1999120208 Results: Crash: Win 95, Win 98, Linux Red Hat 6.0 (Linux2.2). Talkback incident #1665557 No crash: Win NT, Mac 8.5 Call Stack: (Signature = il_image_abort d3504610) il_image_abort [d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 1258] IL_StreamAbort [d:\builds\seamonkey\mozilla\modules\libimg\src\if.cpp, line 1595] NetReaderImpl::StreamAbort [d:\builds\seamonkey\mozilla\modules\libimg\src\ilNetReader.cpp, line 114] ImageConsumer::OnDataAvailable [d:\builds\seamonkey\mozilla\gfx\src\nsImageNetContextAsync.cpp, line 217] nsChannelListener::OnDataAvailable [d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1597] nsChannelListener::OnDataAvailable [d:\builds\seamonkey\mozilla\webshell\src\nsDocLoader.cpp, line 1597] nsHTTPResponseListener::OnDataAvailable [d:\builds\seamonkey\mozilla\netwerk\protocol\http\src\nsHTTPResponseListener.cp p, line 206] nsOnDataAvailableEvent::HandleEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 370] nsStreamListenerEvent::HandlePLEvent [d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 94] PL_HandleEvent [plevent.c, line 538] _md_EventReceiverProc [plevent.c, line 976] KERNEL32.DLL + 0x3663 (0xbff73663) 0x08690016 0x2f617661 Marking as a parity bug.

The problem might also be itermittent since I originally saw it on WinNT.

*** Bug 20679 has been marked as a duplicate of this bug. ***

It did crash for me on Mac and WinNT using today's debug builds. I get on both machines the same stack trace as chrisd reported on Unix and Win95. It always crashes in il_image_abort() because 'ic' is corrupted (Mac) or corresponds to a memory zone that has been freed (WinNT). Changing title to "Crash in il_image_abort()" from "[PP]Crash in StyleContextImpl::AddRef" and reassigning to ImageLib owner.

this is a dupe. *** This bug has been marked as a duplicate of 20605 ***

Verified dup of #20605