the URL opens a second window. I might have moused over the second window just as it opened, I'm not sure. in GlobalWindowImpl, newGlobalObject->SetOpenerWindow(this); //newGlobalObject is null!!! I got this stack: GlobalWindowImpl::Open(GlobalWindowImpl * const 0x0132e5c8, JSContext * 0x013f0e20, long * 0x01d35fcc, unsigned int 2, nsIDOMWindow * * 0x0012eb0c) line 1091 + 50 bytes WindowOpen(JSContext * 0x013f0e20, JSObject * 0x01bb4db8, unsigned int 2, long * 0x01d35fcc, long * 0x0012eba0) line 882 + 28 bytes js_Invoke(JSContext * 0x013f0e20, unsigned int 2, int 0) line 630 + 26 bytes js_Interpret(JSContext * 0x013f0e20, long * 0x0012f100) line 2122 + 15 bytes js_Invoke(JSContext * 0x013f0e20, unsigned int 0, int 0) line 646 + 13 bytes js_Interpret(JSContext * 0x013f0e20, long * 0x0012f6f8) line 2122 + 15 bytes js_Execute(JSContext * 0x013f0e20, JSObject * 0x01bb56e8, JSScript * 0x0141d410, JSFunction * 0x00000000, JSStackFrame * 0x00000000, int 0, long * 0x0012f6f8) line 804 + 13 bytes JS_EvaluateUCScriptForPrincipals(JSContext * 0x013f0e20, JSObject * 0x01bb56e8, JSPrincipals * 0x00000000, unsigned short * 0x01ce6050, unsigned int 1095, char * 0x01321c80, unsigned int 9, long * 0x0012f6f8) line 2226 + 27 bytes JS_EvaluateUCScript(JSContext * 0x013f0e20, JSObject * 0x01bb56e8, unsigned short * 0x01ce6050, unsigned int 1095, char * 0x01321c80, unsigned int 9, long * 0x0012f6f8) line 2208 + 35 bytes JS_EvaluateScript(JSContext * 0x013f0e20, JSObject * 0x01bb56e8, char * 0x01cff728, unsigned int 1095, char * 0x01321c80, unsigned int 9, long * 0x0012f6f8) line 2175 + 33 bytes nsJSContext::EvaluateString(char * 0x01cff728, unsigned int 1095, char * 0x01321c80, unsigned int 9, long * 0x0012f6f8) line 77 + 50 bytes HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 2191 + 46 bytes HTMLContentSink::AddLeaf(HTMLContentSink * const 0x013ea580, const nsIParserNode & {...}) line 1734 + 12 bytes CNavDTD::AddLeaf(const nsIParserNode & {...}) line 2521 + 22 bytes CNavDTD::HandleScriptToken(nsCParserNode & {...}) line 844 + 12 bytes CNavDTD::OpenContainer(const nsIParserNode & {...}, int 1) line 2354 + 12 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x01288c20, nsHTMLTag eHTMLTag_script, nsIParserNode & {...}) line 576 + 14 bytes CNavDTD::HandleStartToken(CToken * 0x01288c20) line 661 + 23 bytes NavDispatchTokenHandler(CToken * 0x01288c20, nsIDTD * 0x0136ab80) line 293 + 12 bytes CTokenHandler::operator()(CToken * 0x01288c20, nsIDTD * 0x0136ab80) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x0136ab80, CToken * 0x01288c20) line 524 + 18 bytes nsParser::BuildModel() line 599 + 16 bytes nsParser::ResumeParse() line 564 nsParser::OnDataAvailable(nsParser * const 0x013e6ba4, nsIURL * 0x01320d70, nsIInputStream * 0x013ab240, int 38) line 774 + 15 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x01320b90, nsIURL * 0x01320d70, nsIInputStream * 0x013ab240, int 38) line 1125 + 30 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x013c1440) line 572 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x013c1444) line 418 + 12 bytes PL_HandleEvent(PLEvent * 0x013c1444) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x01206540) line 357 + 9 bytes _md_EventReceiverProc(void * 0x00a00746, unsigned int 49403, unsigned int 0, long 18900288) line 675 + 9 bytes USER32! 77e71250() 01206540()

Checking in fix now

Using the 11/30 devprev build on Win NT and Win 95, verified bug is fixed. Page does not crash.