Visit http://www.elpais.es Talkback ID8115055 Source for the page can be found at http://rocknroll/users/msanz/publish/pais.txt because the page changes daily

In my local build it crash when Stack trace: SinkContext::Begin(nsHTMLTag, nsIHTMLContent * 0xcdcdcdcd) line 855 + 3 bytes HTMLContentSink::BeginContext(HTMLContentSink * const 0x031c79c0, int 0x00000013) line 1547 CNavDTD::HandleSavedTokensAbove(nsHTMLTag eHTMLTag_table) line 1453 CNavDTD::HandleEndToken(CToken * 0x00e40f50) line 1406 + 12 bytes NavDispatchTokenHandler(CToken * 0x00e40f50, nsIDTD * 0x00f6c610) line 250 + 12 bytes CTokenHandler::operator()(CToken * 0x00e40f50, nsIDTD * 0x00f6c610) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x00f6c610, CToken * 0x00e40f50, nsIParser * 0x031c7860) line 635 + 18 bytes CNavDTD::BuildModel(CNavDTD * const 0x00f6c610, nsIParser * 0x031c7860, nsITokenizer * 0x00f6d640, nsITokenObserver * 0x00000000, nsIContentSink * 0x031c79c0) line 509 + 20 bytes nsParser::BuildModel() line 847 + 34 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 799 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x031c7864, nsIURL * 0x031bdb50, nsIInputStream * 0x031c6e50, unsigned int 0x00000a24) line 1011 + 17 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x031bd150, nsIURL * 0x031bdb50, nsIInputStream * 0x031c6e50, unsigned int 0x00000a24) line 2102 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x031dbda0) line 632 StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x031dbda4) line 471 + 12 bytes PL_HandleEvent(PLEvent * 0x031dbda4) line 476 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00c209a0) line 437 + 9 bytes _md_EventReceiverProc(void * 0x000208ec, unsigned int 0x0000c117, unsigned int 0x00000000, long 0x00c209a0) line 799 + 9 bytes USER32! 77e5111a() When it crash nsresult SinkContext::Begin(nsHTMLTag aNodeType, nsIHTMLContent* aRoot) { if (1 > mStackSize) { nsresult rv = GrowStack(); if (NS_OK != rv) { return rv; } } mStack[0].mType = aNodeType; mStack[0].mContent = aRoot; mStack[0].mFlags = APPENDED; It crash at the NS_ADDREF(aRoot); line below while aRoot == 0xcdcdcdcd nsresult SinkContext::Begin(nsHTMLTag aNodeType, nsIHTMLContent* aRoot) { if (1 > mStackSize) { nsresult rv = GrowStack(); if (NS_OK != rv) { return rv; } } mStack[0].mType = aNodeType; mStack[0].mContent = aRoot; mStack[0].mFlags = APPENDED; NS_ADDREF(aRoot); mStackPos = 1; mTextLength = 0; return NS_OK; } mStackPos = 1; mTextLength = 0; return NS_OK; } Reassign to kipp since he is the last one touch that line.

Checked in a fix yesterday. The URL should render fine ;)

Marking the bug fixed.

Verified on Win NT with M6 build from may 7th