The page in the URL field passes as valid XHTML according to validator.w3.org but makes current mozilla crash with mParser==NULL (according to tor on irc). Tried on both Solaris/Sparc, Win98 and 2000.

Stack trace from a solaris/native tree pulled 5/20 evening: t@1 (l@5) signal SEGV (no mapping at the fault address) in HTMLContentSink::CreateContentObject at line 949 in file "nsHTMLContentSink.cpp" 949 rv = mParser->GetDTD(getter_AddRefs(dtd)); (dbx t@1 l@5) where current thread: t@1 =>[1] HTMLContentSink::CreateContentObject(this = 0x821338, aNode = CLASS, aNodeType = eHTMLTag_parsererror, aForm = (nil), aWebShell = (nil), aResult = 0xffbee278), line 949 in "nsHTMLContentSink.cpp" [2] SinkContext::OpenContainer(this = 0x788508, aNode = CLASS), line 1241 in "nsHTMLContentSink.cpp" [3] HTMLContentSink::OpenContainer(this = 0x821338, aNode = CLASS), line 2903 in "nsHTMLContentSink.cpp" [4] CWellFormedDTD::HandleStartToken(this = 0x7e9c10, aToken = 0x5ca3b8), line 616 in "nsWellFormedDTD.cpp" [5] CWellFormedDTD::HandleErrorToken(this = 0x7e9c10, aToken = 0x884df0), line 676 in "nsWellFormedDTD.cpp" [6] CWellFormedDTD::HandleToken(this = 0x7e9c10, aToken = 0x884df0, aParser = 0x82c090), line 505 in "nsWellFormedDTD.cpp" [7] CWellFormedDTD::BuildModel(this = 0x7e9c10, aParser = 0x82c090, aTokenizer = 0x873458, anObserver = (nil), aSink = 0x821338), line 257 in "nsWellFormedDTD.cpp" [8] nsParser::BuildModel(this = 0x82c090), line 1561 in "nsParser.cpp" [9] nsParser::ResumeParse(this = 0x82c090, allowIteration = 1, aIsFinalChunk = 0), line 1445 in "nsParser.cpp" [10] nsParser::OnDataAvailable(this = 0x82c090, channel = 0x89eb60, aContext = (nil), pIStream = 0x7e9b84, sourceOffset = 0, aLength = 1054U), line 1891 in "nsParser.cpp" [11] nsDocumentOpenInfo::OnDataAvailable(this = 0x8b0788, aChannel = 0x89eb60, aCtxt = (nil), inStr = 0x7e9b84, sourceOffset = 0, count = 1054U), line 189 in "nsURILoader.cpp" [12] nsHTTPFinalListener::OnDataAvailable(this = 0x86f3e0, aChannel = 0x89eb60, aContext = (nil), aStream = 0x7e9b84, aSourceOffset = 0, aCount = 1054U), line 1216 in "nsHTTPResponseListener.cpp" [13] InterceptStreamListener::OnDataAvailable(this = 0x7e9b80, channel = 0x89eb60, ctxt = (nil), inStr = 0x83e150, sourceOffset = 0, count = 1054U), line 1162 in "nsCachedNetData.cpp" [14] nsHTTPChunkConv::OnDataAvailable(this = 0x8a9220, aChannel = 0x89eb60, aContext = (nil), iStr = 0x8fb0ac, aSourceOffset = 0, aCount = 1066U), line 208 in "nsHTTPChunkConv.cpp" [15] nsHTTPServerListener::OnDataAvailable(this = 0x8a3360, channel = 0x8b4dc4, context = 0x89eb60, i_pStream = 0x8fb0ac, i_SourceOffset = 9649U, i_Length = 1066U), line 540 in "nsHTTPResponseListener.cpp" [16] nsOnDataAvailableEvent::HandleEvent(this = 0x82a000), line 405 in "nsAsyncStreamListener.cpp" [17] nsStreamListenerEvent::HandlePLEvent(aEvent = 0x8affc0), line 97 in "nsAsyncStreamListener.cpp" [18] PL_HandleEvent(self = 0x8affc0), line 575 in "plevent.c" [19] PL_ProcessPendingEvents(self = 0xe8a90), line 520 in "plevent.c" [20] nsEventQueueImpl::ProcessPendingEvents(this = 0xe8a60), line 316 in "nsEventQueue.cpp" [21] event_processor_callback(data = 0xe8a60, source = 6, condition = GDK_INPUT_READ), line 143 in "nsAppShell.cpp" [22] our_gdk_io_invoke(source = 0x2701f8, condition = G_IO_IN, data = 0xd9f88), line 55 in "nsAppShell.cpp" [23] g_main_dispatch(0xffbef098, 0xfce71890, 0x0, 0xfce717d0, 0xfce6f680, 0xfce6f680), at 0xfce4291c [24] g_main_iterate(0x1, 0xffffffff, 0xffffffff, 0xfce71898, 0xfce71800, 0xfce7188c), at 0xfce4308c [25] g_main_run(0x2de0e8, 0xfce71890, 0xfce6f680, 0xfce71920, 0xfce71890, 0xfce6f680), at 0xfce43264 [26] gtk_main(0xfd171440, 0xfd0d4da4, 0xfd0bde1c, 0x2de0e8, 0x0, 0x0), at 0xfcfad1d4 [27] nsAppShell::Run(this = 0x11c2f8), line 313 in "nsAppShell.cpp" [28] nsAppShellService::Run(this = 0x3f9c8), line 371 in "nsAppShellService.cpp" [29] main1(argc = 2, argv = 0xffbef684, nativeApp = (nil)), line 904 in "nsAppRunner.cpp" [30] main(argc = 2, argv = 0xffbef684), line 1188 in "nsAppRunner.cpp" (dbx t@1 l@5) p -r dtd dtd = { nsCOMPtr<nsIDTD>::nsCOMPtr_base::mRawPtr = (nil) } (dbx t@1 l@5) p mParser mParser = (nil)

Another one for you.

rickg, has a fix for this. *** This bug has been marked as a duplicate of 39520 ***

Adding crash kw, severity=critical (it should show up in queries for crashes).

Verified: 2000-09-20-09-M18 : Windows 2000-09-20-08-M18 : Mac 2000-09-20-13-M18 : Linux