From n.p.m.general: Recurring crash w/Mozilla-win32 Dec07th nightly build: http://www.registrar.dal.ca/exam/ can consistently crash Mozilla on me. The page has a massive 'pre' inside a table, if that's anything special. I don't have access to a Unix box at the moment to see if its a platform specific thing. In particular, the HTML is like so: ... <BR> <I>*STARTING TIMES ONLY ARE SHOWN</I> <TABLE> <!-- hmm, no TD, no TR --> <PRE> ... big (~35K) PRE section Adding <TD> stops the crash. (Without the TD, the PRE section begins to fill in as Times (i.e., not monospace) font, but then crashes after a few seconds). [Attaching the crasher page for posterity].

Another case where we hit an assert in the sink because mStackPos is 0. NTDLL! 77f9d715() nsDebug::Assertion(const char * 0x0237163c, const char * 0x0237162c, const char * 0x023715f0, int 1535) line 185 + 13 bytes SinkContext::AddLeaf(nsIHTMLContent * 0x01de62e4) line 1535 + 35 bytes SinkContext::AddLeaf(const nsIParserNode & {...}) line 1498 HTMLContentSink::AddLeaf(HTMLContentSink * const 0x01da5090, const nsIParserNode & {...}) line 2774 + 15 bytes CNavDTD::AddLeaf(const nsIParserNode * 0x01d430a8) line 3109 + 28 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x01d97110, nsHTMLTag eHTMLTag_hr, nsIParserNode * 0x01d430a8) line 1052 + 12 bytes CNavDTD::HandleStartToken(CToken * 0x01d97110) line 1352 + 22 bytes CNavDTD::HandleToken(CNavDTD * const 0x01e25328, CToken * 0x01d97110, nsIParser * 0x01d9a168) line 752 + 12 bytes CNavDTD::HandleSavedTokens(int 2) line 1657 + 23 bytes CNavDTD::HandleOmittedTag(CToken * 0x01d95228, nsHTMLTag eHTMLTag_text, nsHTMLTag eHTMLTag_table, nsIParserNode * 0x01dbfe50) line 1239 + 12 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x01d95228, nsHTMLTag eHTMLTag_text, nsIParserNode * 0x01dbfe50) line 987 + 24 bytes CNavDTD::HandleStartToken(CToken * 0x01d95228) line 1352 + 22 bytes CNavDTD::HandleToken(CNavDTD * const 0x01e25328, CToken * 0x01d95228, nsIParser * 0x01d9a168) line 752 + 12 bytes CNavDTD::BuildModel(CNavDTD * const 0x01e25328, nsIParser * 0x01d9a168, nsITokenizer * 0x01d309c0, nsITokenObserver * 0x00000000, nsIContentSink * 0x01da5090) line 524 + 20 bytes nsParser::BuildModel() line 1045 + 34 bytes nsParser::ResumeParse(nsIDTD * 0x00000000, int 0) line 971 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x01d9a16c, nsIChannel * 0x01dd98d8, nsISupports * 0x00000000, nsIInputStream * 0x00ef6400, unsigned int 0, unsigned int 2402) line 1331 + 19 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x01dd09a0, nsIChannel * 0x01dd98d8, nsISupports * 0x00000000, nsIInputStream * 0x00ef6400, unsigned int 0, unsigned int 2402) line 1450 + 43 bytes nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x01dda048, nsIChannel * 0x01dd98d8, nsISupports * 0x00000000, nsIInputStream * 0x00ef6400, unsigned int 0, unsigned int 2402) line 212 + 46 bytes nsChannelListener::OnDataAvailable(nsChannelListener * const 0x00f05808, nsIChannel * 0x01dd98d8, nsISupports * 0x00000000, nsIInputStream * 0x00ef6400, unsigned int 0, unsigned int 2402) line 1599 nsHTTPResponseListener::OnDataAvailable(nsHTTPResponseListener * const 0x01dd9c10, nsIChannel * 0x01e207c8, nsISupports * 0x01dd98d8, nsIInputStream * 0x00ef6400, unsigned int 32768, unsigned int 2402) line 196 + 55 bytes nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x01d50220) line 370 nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x01d51e38) line 93 + 12 bytes PL_HandleEvent(PLEvent * 0x01d51e38) line 522 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00b30448) line 483 + 9 bytes _md_EventReceiverProc(HWND__ * 0x00600362, unsigned int 49477, unsigned int 0, long 11732040) line 947 + 9 bytes USER32! 77e135f8() USER32! 77e13769() USER32! 77e17b9a() main(int 1, char * * 0x00a92c48) line 137 + 11 bytes mainCRTStartup() line 338 + 17 bytes

In an attempt to get my bug list in order again, marking all the bugs I have currently as ASSIGNED.

We hit the assertion since the parser is incorrectly managing saved tokens. DUPing with 20645. *** This bug has been marked as a duplicate of 20645 ***

Marking as verified dup of 20645.