The browser crashes when it finds an URL in a style declaration, as in <td style="background-image: url(bg.gif);"> I looked into this a bit. It seems that the problem starts in layout/html/content/src/nsGenericHTMLElement.cpp, line 546: result = css->ParseDeclarations(aValue, nsnull, rule); The nsnull value in the aBaseURL parameter gets into CSSParserImpl::mURL. Later on, this is passed to NS_MakeAbsoluteURL (in nsCSSParser.cpp, line 1937), and everything blows when a method call is attempted on the pointer (network/module/nsNetService.cpp, line 1087). Now, I'm really ashamed for not fixing this myself -I think this could be fixed easily, but I'm still finding my way through the code and the concepts. So here you have it, someone please deal with this. Meanwhile, I'll be trying to make a patch as an exercise (but please don't depend on it).

Peter -- I'd love to fix this, but hey, you made your own parser, so now you have to live in it. :) Please fix.

Actually, the bug is in the code that calls the parser, it's not passing required params. Don't bother trying a patch (thanks for looking into it though). I already have this fixed. It isn't checked in yet until I resolve dealing with issues related to <BASE HREF=> and inline style... *** This bug has been marked as a duplicate of 1355 ***

Assigning myself qa contact and verifying bug duplicate.