In, viewer, I'm getting the following crash. Norris, I know you are probably very busy, but you and I could probably both save time if you ran some of my regression tests, especially the ones dealing directly with js. nsQueryInterface::operator()(const nsID & {...}, void * * 0x0012ce08) line 31 + 23 bytes nsCOMPtr<nsIScriptObjectOwner>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 795 + 18 bytes nsCOMPtr<nsIScriptObjectOwner>::nsCOMPtr<nsIScriptObjectOwner>(const nsQueryInterface & {...}) line 508 nsJSUtils::nsConvertObjectToJSVal(nsISupports * 0x00c02a70, JSContext * 0x02000110, JSObject * 0x00db8dc8, long * 0x0012d68c) line 259 GetHTMLCollectionProperty(JSContext * 0x02000110, JSObject * 0x00db8dc8, long 13713676, long * 0x0012d68c) line 128 + 24 bytes js_GetProperty(JSContext * 0x02000110, JSObject * 0x00db8dc8, long 33674624, long * 0x0012d68c) line 1837 + 125 bytes js_Interpret(JSContext * 0x02000110, long * 0x0012d820) line 2229 + 1057 bytes js_Invoke(JSContext * 0x02000110, unsigned int 2, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x02000110, long * 0x0012e068) line 2273 + 15 bytes js_Invoke(JSContext * 0x02000110, unsigned int 2, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x02000110, long * 0x0012e8b0) line 2273 + 15 bytes js_Invoke(JSContext * 0x02000110, unsigned int 0, unsigned int 0) line 681 + 13 bytes js_Interpret(JSContext * 0x02000110, long * 0x0012f0f8) line 2273 + 15 bytes js_Invoke(JSContext * 0x02000110, unsigned int 1, unsigned int 2) line 681 + 13 bytes js_InternalInvoke(JSContext * 0x02000110, JSObject * 0x00d12cb8, long 14386808, unsigned int 0, unsigned int 1, long * 0x0012f284, long * 0x0012f230) line 754 + 19 bytes JS_CallFunctionValue(JSContext * 0x02000110, JSObject * 0x00d12cb8, long 14386808, unsigned int 1, long * 0x0012f284, long * 0x0012f230) line 2772 + 31 bytes nsJSContext::CallEventHandler(nsJSContext * const 0x02000f50, void * 0x00d12cb8, void * 0x00db8678, unsigned int 1, void * 0x0012f284, int * 0x0012f280) line 562 + 33 bytes nsJSEventListener::HandleEvent(nsIDOMEvent * 0x020ab1d4) line 128 + 57 bytes nsEventListenerManager::HandleEventSubType(nsListenerStruct * 0x02037220, nsIDOMEvent * 0x020ab1d4, unsigned int 1) line 677 + 19 bytes nsEventListenerManager::HandleEvent(nsIPresContext * 0x0225bf10, nsEvent * 0x0012fd24, nsIDOMEvent * * 0x0012f680, unsigned int 7, nsEventStatus * 0x0012fd64) line 1228 + 31 bytes GlobalWindowImpl::HandleDOMEvent(GlobalWindowImpl * const 0x01ffd614, nsIPresContext * 0x0225bf10, nsEvent * 0x0012fd24, nsIDOMEvent * * 0x0012f680, unsigned int 1, nsEventStatus * 0x0012fd64) line 3327 nsWebShell::OnEndDocumentLoad(nsWebShell * const 0x014e0da0, nsIDocumentLoader * 0x014f4ca0, nsIChannel * 0x02258e70, unsigned int 0) line 3171 + 34 bytes nsDocLoaderImpl::FireOnEndDocumentLoad(nsDocLoaderImpl * 0x014f4ca0, nsIChannel * 0x02258e70, unsigned int 0) line 603 nsDocLoaderImpl::DocLoaderIsEmpty(unsigned int 0) line 494 nsDocLoaderImpl::OnStopRequest(nsDocLoaderImpl * const 0x014f4ca4, nsIChannel * 0x020211a0, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 438 nsLoadGroup::RemoveChannel(nsLoadGroup * const 0x014f09b0, nsIChannel * 0x020211a0, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 535 + 42 bytes nsFileChannel::OnStopRequest(nsFileChannel * const 0x020211a4, nsIChannel * 0x02020f00, nsISupports * 0x00000000, unsigned int 0, const unsigned short * 0x00000000) line 455 nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x02020850) line 279 nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02020590) line 93 + 12 bytes PL_HandleEvent(PLEvent * 0x02020590) line 526 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00cb0740) line 487 + 9 bytes _md_EventReceiverProc(HWND__ * 0x000c042c, unsigned int 49299, unsigned int 0, long 13305664) line 975 + 9 bytes USER32! DispatchMessageWorker@8 + 135 bytes USER32! DispatchMessageA@4 + 11 bytes nsNativeViewerApp::Run() line 84 main(int 1, char * * 0x00c01870) line 157 + 11 bytes mainCRTStartup() line 338 + 17 bytes

It also happens on most of the pages listed in table/dom/file_list.txt after deleteTBodyExpand1.html.

Hmm. Works for me in both viewer and mozilla.exe. rogerl is a good person for JavaScript engine problems in general--I haven't been making many changes in the core C engine for a while.