Platforms are FreeBSD 4.0-CURRENT (19990505175254) with M5 tarball Win98 (4.10.1998) with M5+fullcircle When opening said URL you will see you browser crash and burn. This occurs both with viewer and apprunner on both platforms. I have taken dumps (available on request), I will attach a backtrace and I will mention the number of this PR in the full-circle comment field. I'll try and investigate a little more myself if I have time...

(gdb) run Starting program: /usr/home/gelderen/mozilla/dist/bin/./apprunner nsComponentManager: Using components dir: /usr/home/gelderen/mozilla/dist/bin/components ProfileManager (nsProfile) : Startup : Get Registry handle width was not set height was not set ProfileManager (nsProfile) : Startup : Get Registry handle ProfileManager : GetProfileCount Registry opened OK. ProfileManager : GetSingleProfile Registry opened OK. defaultProfileManager : GetProfileDir Registry opened OK. Registry:Profiles opened OK. ProfileManager : GetCurrentProfileDir ProfileManager : GetCurrentProfile Registry opened OK. ProfileManager : GetProfileDir Registry opened OK. Registry:Profiles opened OK. Using '/usr/home/gelderen/mozilla/dist/bin' as the resource: base Reading file... Reading file...Done Reading file... Using Expat for parsing XML... Reading file...Done GFX: dpi=96 t2p=0.0666667 p2t=15 depth=24 Reading file... Using Expat for parsing XML... Reading file...Done Got thew event queue from the service Calling gdk_input with event queue Reading file... Reading file...Done Using Expat for parsing XML... Note: frameverifytree is disabled Note: verifyreflow is disabled Using Expat for parsing XML... Using Expat for parsing XML... Using Expat for parsing XML... Doing Startup... Creating browser app core BrowserAppCore has been created. Adding app core to AppCoreManager in the base initialization. Setting content window Init! Reading file... Added page file:////usr/home/gelderen/mozilla/dist/bin/res/samples/BrowserInitPage.html to the rdf:history datasource Got a handle to forward menu item Setting forward menu item disabled Obtained MenuItem Back Setting Back menuitem to enabled Document file:////usr/home/gelderen/mozilla/dist/bin/res/samples/BrowserInitPage.html loaded successfully Reading file...Done Using Expat for parsing XML... adding "resource:/res/rdf/remote-flash-1.rdf" to the tree poll interval = "null" adding "resource:/res/rdf/remote-flash-2.rdf" to the tree poll interval = "null" adding "resource:/res/rdf/remote-flash-3.rdf" to the tree poll interval = "null" Using Expat for parsing XML... Using Expat for parsing XML... Using Expat for parsing XML... Adding app core to AppCoreManager in the base initialization. ---------------------------- -- Find Bookmark Shortcut -- user input: www.telegraaf.nl ---------------------------- FindBookmarkShortcut: in='www.telegraaf.nl' out='' Alert: Alert! did not find a converter or decoderAdded page http://www.telegraaf.nl/krant/vandaag/teksten/voorpagina.html to the rdf:history datasource Got a handle to forward menu item Setting forward menu item disabled Obtained MenuItem Back Setting Back menuitem to enabled Document http://www.telegraaf.nl/krant/vandaag/teksten/voorpagina.html loaded successfully Alert: Alert! did not find a converter or decoderAdded page http://www.telegraaf.nl/krant/vandaag/teksten/nederland.html to the rdf:history datasource Got a handle to forward menu item Setting forward menu item disabled Obtained MenuItem Back Setting Back menuitem to enabled Document http://www.telegraaf.nl/krant/vandaag/teksten/nederland.html loaded successfully Program received signal SIGSEGV, Segmentation fault. 0x285a5fec in SinkContext::CloseContainer (this=0x86900e0, aNode=@0xbfbfd148) at nsHTMLContentSink.cpp:978 978 content->Compact(); (gdb) backtrace #0 0x285a5fec in SinkContext::CloseContainer (this=0x86900e0, aNode=@0xbfbfd148) at nsHTMLContentSink.cpp:978 #1 0x285a8a15 in HTMLContentSink::CloseContainer (this=0x82c1300, aNode=@0xbfbfd148) at nsHTMLContentSink.cpp:1856 #2 0x2876a02a in CNavDTD::CloseContainer (this=0x8244c00, aNode=@0xbfbfd148, aTag=eHTMLTag_p, aUpdateStyles=1) at CNavDTD.cpp:2573 #3 0x2876a183 in CNavDTD::CloseContainersTo (this=0x8244c00, anIndex=2, aTag=eHTMLTag_p, aUpdateStyles=1) at CNavDTD.cpp:2605 #4 0x2876a258 in CNavDTD::CloseContainersTo (this=0x8244c00, aTag=eHTMLTag_p, aUpdateStyles=1) at CNavDTD.cpp:2626 #5 0x28767ed7 in CNavDTD::HandleEndToken (this=0x8244c00, aToken=0x81e3500) at CNavDTD.cpp:1410 #6 0x287658d5 in NavDispatchTokenHandler (aToken=0x81e3500, aDTD=0x8244c00) at CNavDTD.cpp:250 #7 0x287765dc in CTokenHandler::operator() (this=0x8337700, aToken=0x81e3500, aDTD=0x8244c00) at nsTokenHandler.cpp:80 #8 0x287665b6 in CNavDTD::HandleToken (this=0x8244c00, aToken=0x81e3500, aParser=0x866f800) at CNavDTD.cpp:629 #9 0x287661ae in CNavDTD::BuildModel (this=0x8244c00, aParser=0x866f800, aTokenizer=0x83b47a0, anObserver=0x0, aSink=0x82c1300) at CNavDTD.cpp:509 #10 0x28773b93 in nsParser::BuildModel (this=0x866f800) at nsParser.cpp:886 #11 0x28773a7c in nsParser::ResumeParse (this=0x866f800, aDefaultDTD=0x0) at nsParser.cpp:838 #12 0x28773fca in nsParser::OnDataAvailable (this=0x866f800, aURL=0x81f4e80, pIStream=0x867f0c0, aLength=1530) at nsParser.cpp:1050 #13 0x2831929b in nsDocumentBindInfo::OnDataAvailable (this=0x8579dc0, aURL=0x81f4e80, aStream=0x867f0c0, aLength=1530) at nsDocLoader.cpp:2070 #14 0x282f8c5b in stub_put_block (stream=0x868efa0, buffer=0x809b000 "elesport]\"></A><BR>\n \t</TD>\n \t<TD VALIGN=\"TOP\" ALIGN=\"CENTER\" WIDTH=\"70\" HEIGHT=\"20\">\n \t\t<BR CLEAR=\"ALL\">\n \t\t<A HREF=\"financien.html\" onMouseOver=\"window.status='[De Financi&euml;le Telegraaf]'; retur"..., length=1530) at nsStubContext.cpp:827 #15 0x2829db35 in net_MemCacheWrite (stream=0x83b4760, buffer=0x809b000 "elesport]\"></A><BR>\n \t</TD>\n \t<TD VALIGN=\"TOP\" ALIGN=\"CENTER\" WIDTH=\"70\" HEIGHT=\"20\">\n \t\t<BR CLEAR=\"ALL\">\n \t\t<A HREF=\"financien.html\" onMouseOver=\"window.status='[De Financi&euml;le Telegraaf]'; retur"..., len=1530) at mkmemcac.c:660 #16 0x281fe5cb in net_pull_http_data (ce=0x832be80) at mkhttp.c:3170 #17 0x281fefa5 in net_ProcessHTTP (ce=0x832be80) at mkhttp.c:3570 #18 0x282c8d6f in NET_ProcessNet (ready_fd=0x8080ca0, fd_type=2) at mkgeturl.c:3355 #19 0x282d0f75 in NET_PollSockets () at mkselect.c:320 #20 0x282f2376 in nsNetlibService::NetPollSocketsCallback (aTimer=0x80b5040, aClosure=0x80a6d80) at nsNetService.cpp:1270 #21 0x281dead5 in TimerImpl::FireTimeout (this=0x80b5040) at nsTimer.cpp:73 #22 0x281defba in nsTimerExpired (aCallData=0x80b5040) at nsTimer.cpp:189 #23 0x28adab73 in g_timeout_dispatch () from /usr/local/lib/libglib12.so.1 #24 0x28ad9eb0 in g_main_dispatch () from /usr/local/lib/libglib12.so.1 #25 0x28ada3ff in g_main_iterate () from /usr/local/lib/libglib12.so.1 #26 0x28ada57d in g_main_run () from /usr/local/lib/libglib12.so.1 #27 0x28a09719 in gtk_main () from /usr/X11R6/lib/libgtk12.so.1 #28 0x28113311 in nsAppShell::Run (this=0x80b6570) at nsAppShell.cpp:203 #29 0x2807e3ad in nsAppShellService::Run (this=0x80a7080) at nsAppShellService.cpp:186 #30 0x804c590 in main (argc=1, argv=0xbfbfdb78) at nsAppRunner.cpp:462 #31 0x804bbdd in _start () (gdb)

Linux M5 (Binary distribution on RedHat) bombs too. I think upping severity is justified.

Not crashing on NT. Please look into this to determine where the problem is, then pass it back.

Tested using 5/13 Viewer and Apprunner on Win 95, Win NT, Win 98, Linux(Viewer only) and Mac8.5(5/12 Viewer and Apprunner). Loaded page on all platforms - no crashes. Unable to reproduce bug. WORKSFORME.

I re-tested the Win98 machine that originally crashed (under identical circumstances except that I used the last-built version of Mozilla dated 19990513135900, build ID 1999050718). That one works for me, too. Right now I'm building the latest Mozilla from CVS on the FreeBSD machine and I'll post the results.

QA Assigning to self for verification.

Can't reproduce on 6.17.99 AM builds, as checked on Win NT 4 SP3, Mac OS and Linux; thus, verifying fixed.