Crash loading www.limdep.com/index.htm NTDLL! 77f76274() nsDebug::PreCondition(char * 0x006c79d0, char * 0x006c79c0, char * 0x006c797c, int 1647) line 110 + 13 bytes HTMLContentSink::OpenBody(HTMLContentSink * const 0x0133a6a0, const nsIParserNode & {...}) line 1647 + 39 bytes CNavDTD::OpenBody(const nsIParserNode & {...}) line 1955 + 28 bytes CNavDTD::OpenContainer(const nsIParserNode & {...}, int 1) line 2100 + 12 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x0012fbb4, nsHTMLTag eHTMLTag_body, nsIParserNode & {...}) line 781 + 14 bytes CNavDTD::HandleStartToken(CToken * 0x0012fbb4) line 874 + 23 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x012f6ed0, nsHTMLTag eHTMLTag_noframes, nsIParserNode & {...}) line 734 + 12 bytes CNavDTD::HandleStartToken(CToken * 0x012f6ed0) line 874 + 23 bytes NavDispatchTokenHandler(CToken * 0x012f6ed0, nsIDTD * 0x012d54d0) line 261 + 12 bytes CTokenHandler::operator()(CToken * 0x012f6ed0, nsIDTD * 0x012d54d0) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x012d54d0, CToken * 0x012f6ed0, nsIParser * 0x013382c0) line 550 + 18 bytes CNavDTD::BuildModel(CNavDTD * const 0x012d54d0, nsIParser * 0x013382c0, nsITokenizer * 0x012d5920) line 478 + 20 bytes nsParser::BuildModel() line 718 + 20 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 672 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x013382c4, nsIURL * 0x012d9280, nsIInputStream * 0x0132e8f0, unsigned int 1721) line 868 + 17 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x012d9200, nsIURL * 0x012d9280, nsIInputStream * 0x0132e8f0, unsigned int 1721) line 1705 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x012e5a00) line 624 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x012e5a04) line 464 + 12 bytes PL_HandleEvent(PLEvent * 0x012e5a04) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x0121f1f0) line 357 + 9 bytes _md_EventReceiverProc(void * 0x046100f8, unsigned int 49361, unsigned int 0, long 19001840) line 675 + 9 bytes USER32! 77e71268() 0121f1f0()

Fixed by improvements to new DTD system; also fixed one in comment parsing.

Verified that page doesn't crash (1.28.99 Mac OS, Win32 & Linux builds). Michael, if you believe there may still be a problem, please do re-open.