going to webmonkey.com crashes Gecko - build 011398. It loads the frameset but crashes shortly after.

Peter, here's the stack trace. It looks like NS_MakeAbsoluteURL is being used in a way that's different from how it's intended. I don't know whether it changed or whether that's always been the way it is NS_MakeAbsoluteURL(nsIURL * 0x00000000, const nsString & {""}, const nsString & {"/webmonkey/meta/toolbar/objects/clickRegion.gif"}, nsString & {""}) line 1088 + 7 bytes CSSParserImpl::ParseURL(int & 0x00000000, nsCSSValue & {...}) line 1937 + 28 bytes CSSParserImpl::ParseVariant(int & 0x00000000, nsCSSValue & {...}, int 0x00060010, const int * 0x00000000, int & 0x00000000) line 1773 + 19 bytes CSSParserImpl::ParseVariant(int & 0x00000000, nsICSSDeclaration * 0x0166bd80, int 0x00000005, int 0x00060010, const int * 0x00000000, int & 0x00000000) line 1651 + 28 bytes CSSParserImpl::ParseProperty(int & 0x00000000, nsICSSDeclaration * 0x0166bd80, int 0x00000005) line 2068 + 31 bytes CSSParserImpl::ParseProperty(int & 0x00000000, nsICSSDeclaration * 0x0166bd80, int 0x00000005, int & 0x00000003) line 2041 CSSParserImpl::ParseDeclaration(int & 0x00000000, nsICSSDeclaration * 0x0166bd80, int 0x00000000, int & 0x00000003) line 1401 + 24 bytes CSSParserImpl::ParseDeclarationBlock(int & 0x00000000, int 0x00000000) line 1260 + 24 bytes CSSParserImpl::ParseDeclarations(CSSParserImpl * const 0x0166a2b0, const nsString & {"position: absolute; left: 130; top: 0; width: 12px; height: 722px; background-color:blue; margin: 0; background-image: url(/we"}, nsIURL * 0x00000000, nsIStyleRule * & 0x0012fb88) line 387 + 14 bytes nsGenericHTMLElement::SetAttribute(int 0x00000003, nsIAtom * 0x00f40990 {"STYLE"}, const nsString & {"position: absolute; left: 130; top: 0; width: 12px; height: 722px; background-color:blue; margin: 0; background-image: url(/we"}, int 0x00000000) line 459 + 22 bytes nsHTMLDivElement::SetAttribute(nsHTMLDivElement * const 0x016697dc, int 0x00000003, nsIAtom * 0x00f40990 {"STYLE"}, const nsString & {"position: absolute; left: 130; top: 0; width: 12px; height: 722px; background-color:blue; margin: 0; background-image: url(/we"}, int 0x00000000) line 67 + 30 bytes AddAttributes(const nsIParserNode & {...}, nsIHTMLContent * 0x016697dc, nsIScriptContextOwner * 0x00f9898c) line 478 SinkContext::OpenContainer(const nsIParserNode & {...}) line 965 + 17 bytes HTMLContentSink::OpenContainer(HTMLContentSink * const 0x00f9c560, const nsIParserNode & {...}) line 1826 CNavDTD::OpenContainer(const nsIParserNode & {...}, int 0x00000001) line 2124 + 22 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x01664de0, nsHTMLTag eHTMLTag_div, nsIParserNode & {...}) line 773 + 14 bytes CNavDTD::HandleStartToken(CToken * 0x01664de0) line 870 + 23 bytes NavDispatchTokenHandler(CToken * 0x01664de0, nsIDTD * 0x0161c720) line 261 + 12 bytes CTokenHandler::operator()(CToken * 0x01664de0, nsIDTD * 0x0161c720) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x0161c720, CToken * 0x01664de0, nsIParser * 0x00f9c670) line 548 + 18 bytes CNavDTD::BuildModel(CNavDTD * const 0x0161c720, nsIParser * 0x00f9c670) line 478 + 20 bytes nsParser::BuildModel() line 717 + 16 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 673 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x00f9c674, nsIURL * 0x00f99f60, nsIInputStream * 0x00f9b390, unsigned int 0x00000cb2) line 868 nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x00f98060, nsIURL * 0x00f99f60, nsIInputStream * 0x00f9b390, unsigned int 0x00000cb2) line 1682 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x00fac0c0) line 626 StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x00fac0c4) line 465 + 12 bytes PL_HandleEvent(PLEvent * 0x00fac0c4) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00ebfd00) line 357 + 9 bytes _md_EventReceiverProc(HWND__ * 0x0076052e, unsigned int 0x0000c101, unsigned int 0x00000000, long 0x00ebfd00) line 675 + 9 bytes USER32! 77e71250() 00ebfd

The problem is that the CSS parser is trying to compute a URL as relative to the document's bsae URL, but the attribute parsing code never bothered to give the CSS parser the document's URL. Already fixed in my tree, checking in within minutes. *** This bug has been marked as a duplicate of 1355 ***