code: HTMLContentSink::GetCurrentContainer(eHTMLTags* aType) { nsIHTMLContent* parent; if (mStackPos <= 2) { // assume HTML and BODY/FRAMESET are on the stack if (mBody) { parent = mBody; *aType = eHTMLTag_body; } else { parent = mFrameset; *aType = eHTMLTag_frameset; } } else { parent = mContainerStack[mStackPos - 1]; // <<---------- *aType = mNodeStack[mStackPos - 1]; } return parent; } mStackPos 17326001 crash stack: HTMLContentSink::GetCurrentContainer(nsHTMLTag * 0x0012f270) line 1212 + 12 bytes HTMLContentSink::AddLeaf(HTMLContentSink * const 0x01494cb8, const nsIParserNode & {...}) line 1263 + 12 bytes CNavDTD::AddLeaf(const nsIParserNode & {...}) line 2748 + 22 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x0113f890, nsHTMLTag eHTMLTag_newline, nsIParserNode & {...}) line 735 + 12 bytes CNavDTD::HandleStartToken(CToken * 0x0113f890) line 853 + 23 bytes NavDispatchTokenHandler(CToken * 0x0113f890, nsIDTD * 0x01476890) line 427 + 12 bytes CTokenHandler::operator()(CToken * 0x0113f890, nsIDTD * 0x01476890) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x01476890, CToken * 0x0113f890) line 679 + 18 bytes nsParser::BuildModel() line 586 + 16 bytes nsParser::ResumeParse() line 551 nsParser::OnDataAvailable(nsParser * const 0x01143484, nsIURL * 0x011318d0, nsIInputStream * 0x01140580, int 8066) line 761 + 15 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x01131870, nsIURL * 0x011318d0, nsIInputStream * 0x01140580, int 8066) line 977 + 30 bytes stub_put_block(_NET_StreamClass * 0x01140530, char * 0x00fe9278, long 8066) line 560 + 36 bytes net_MemCacheWrite(_NET_StreamClass * 0x011c7ce0, char * 0x00fe9278, long 8066) line 661 + 24 bytes net_pull_http_data(_ActiveEntry * 0x011313f0) line 3003 + 29 bytes net_ProcessHTTP(_ActiveEntry * 0x011313f0) line 3389 + 9 bytes NET_ProcessNet(PRFileDesc * 0x010b2fe0, int 2) line 3297 + 13 bytes NET_PollSockets() line 180 + 18 bytes nsNetlibService::NetPollSocketsCallback(nsITimer * 0x0112a300, void * 0x01013e60) line 502 TimerImpl::Fire(unsigned long 1626839301) line 321 + 17 bytes TimerImpl::ProcessTimeouts(unsigned long 1626839301) line 199 FireTimeout(void * 0x00000000, unsigned int 275, unsigned int 15129, unsigned long 1626839301) line 103 + 9 bytes USER32! 77e7128c() main(int 2, char * * 0x00ff4f20) line 95 mainCRTStartup() line 338 + 17 bytes KERNEL32! 77f1b304()

This URL no longer crashes Viewer. [Checked 2.1.99 builds on Win32 & Mac OS, as well as the 1.29.99 buildLinux.]

(Thus, bug marked as verified.)

mid-air collision ? / bugzilla cleanup Reopening (current State: verfied and no resolution)

fixed

verified