if many <title> tag is used in a Home Page, mozilla hangs up. http://www.vmware.com/support/ws3/doc/ws30_disks4.html#1009931

Although the site should probably evangelised, this specific issue is browser, not evangelism. The browser should not hang - period. Confirming this bug on Linux trunk 2001092206 - after removing all of the <title>foo</title> instances throughout the body, I am able to load the page fine. ->Parser for triaging.

I get the following stack: EnumPseudoRulesMatching(nsISupports * 0x0411a864, void * 0x00121d48) line 892 + 19 bytes nsSupportsArray::EnumerateForwards(nsSupportsArray * const 0x040bef70, int (nsISupports *, void *)* 0x01ce8ad0 EnumPseudoRulesMatching(nsISupports *, void *), void * 0x00121d48) line 669 + 20 bytes StyleSetImpl::WalkRuleProcessors(int (nsISupports *, void *)* 0x01ce8ad0 EnumPseudoRulesMatching(nsISupports *, void *), void * 0x00121d48, nsIContent * 0x040f2970) line 1716 StyleSetImpl::ResolvePseudoStyleFor(nsIPresContext * 0x0411d200, nsIContent * 0x040f2970, nsIAtom * 0x010eacd0, nsIStyleContext * 0x03ca02e4, int 0, nsICSSPseudoComparator * 0x00000000) line 922 nsPresContext::ResolvePseudoStyleWithComparator(nsPresContext * const 0x0411d200, nsIContent * 0x040f2970, nsIAtom * 0x010eacd0, nsIStyleContext * 0x03ca02e4, int 0, nsICSSPseudoComparator * 0x00000000, nsIStyleContext * * 0x00121e40) line 748 + 46 bytes nsPresContext::ResolvePseudoStyleContextFor(nsPresContext * const 0x0411d200, nsIContent * 0x040f2970, nsIAtom * 0x010eacd0, nsIStyleContext * 0x03ca02e4, int 0, nsIStyleContext * * 0x00121e40) line 727 nsCSSFrameConstructor::ResolveStyleContext(nsIPresContext * 0x0411d200, nsIFrame * 0x03e28d98, nsIContent * 0x040f2910, nsIAtom * 0x010ecbe0, nsIStyleContext * * 0x00121e40) line 6849 + 42 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f2910, nsIFrame * 0x03e28d98, nsFrameItems & {...}) line 7251 + 53 bytes nsCSSFrameConstructor::ProcessBlockChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f2970, nsIFrame * 0x03e28d98, int 1, nsFrameItems & {...}, int 1) line 12778 + 37 bytes nsCSSFrameConstructor::ConstructBlock(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03d535e0, nsIContent * 0x040f2970, nsIFrame * 0x03e33e40, nsIStyleContext * 0x03ca02e4, nsIFrame * 0x03e28d98) line 12727 + 36 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03d535e0, nsIContent * 0x040f2970, nsIFrame * 0x03e33e40, nsIStyleContext * 0x03ca02e4, nsFrameItems & {...}) line 6591 + 43 bytes nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f2970, nsIFrame * 0x03e33e40, nsIAtom * 0x010e7d50, int 3, nsIStyleContext * 0x03ca02e4, nsFrameItems & {...}, int 0) line 7394 + 45 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f2970, nsIFrame * 0x03e33e40, nsFrameItems & {...}) line 7266 + 56 bytes nsCSSFrameConstructor::ProcessBlockChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f6bc0, nsIFrame * 0x03e33e40, int 1, nsFrameItems & {...}, int 1) line 12778 + 37 bytes nsCSSFrameConstructor::ConstructBlock(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cac2f4, nsIContent * 0x040f6bc0, nsIFrame * 0x03e298e8, nsIStyleContext * 0x03d70024, nsIFrame * 0x03e33e40) line 12727 + 36 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cac2f4, nsIContent * 0x040f6bc0, nsIFrame * 0x03e298e8, nsIStyleContext * 0x03d70024, nsFrameItems & {...}) line 6591 + 43 bytes nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f6bc0, nsIFrame * 0x03e298e8, nsIAtom * 0x010dd900, int 3, nsIStyleContext * 0x03d70024, nsFrameItems & {...}, int 0) line 7394 + 45 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f6bc0, nsIFrame * 0x03e298e8, nsFrameItems & {...}) line 7266 + 56 bytes nsCSSFrameConstructor::ProcessInlineChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f0a80, nsIFrame * 0x03e298e8, int 1, nsFrameItems & {...}, int * 0x00122768) line 13074 + 43 bytes nsCSSFrameConstructor::ConstructInline(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x040f0a80, nsIFrame * 0x03e24538, nsIStyleContext * 0x03dbfe0c, int 0, nsIFrame * 0x03e298e8, nsIFrame * * 0x001229c8, nsIFrame * * 0x00122998) line 12859 + 38 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x040f0a80, nsIFrame * 0x03e24538, nsIStyleContext * 0x03dbfe0c, nsFrameItems & {...}) line 6606 + 53 bytes nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f0a80, nsIFrame * 0x03e24538, nsIAtom * 0x010e9bd0, int 3, nsIStyleContext * 0x03dbfe0c, nsFrameItems & {...}, int 0) line 7394 + 45 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x040f0a80, nsIFrame * 0x03e24538, nsFrameItems & {...}) line 7266 + 56 bytes nsCSSFrameConstructor::ProcessInlineChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03c82dc0, nsIFrame * 0x03e24538, int 1, nsFrameItems & {...}, int * 0x00122c28) line 13074 + 43 bytes nsCSSFrameConstructor::ConstructInline(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03c82dc0, nsIFrame * 0x03e22eb4, nsIStyleContext * 0x03dd9060, int 0, nsIFrame * 0x03e24538, nsIFrame * * 0x00122e88, nsIFrame * * 0x00122e58) line 12859 + 38 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03c82dc0, nsIFrame * 0x03e22eb4, nsIStyleContext * 0x03dd9060, nsFrameItems & {...}) line 6606 + 53 bytes nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03c82dc0, nsIFrame * 0x03e22eb4, nsIAtom * 0x010e9bd0, int 3, nsIStyleContext * 0x03dd9060, nsFrameItems & {...}, int 0) line 7394 + 45 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03c82dc0, nsIFrame * 0x03e22eb4, nsFrameItems & {...}) line 7266 + 56 bytes nsCSSFrameConstructor::ProcessInlineChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a819d0, nsIFrame * 0x03e22eb4, int 1, nsFrameItems & {...}, int * 0x001230e8) line 13074 + 43 bytes nsCSSFrameConstructor::ConstructInline(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03a819d0, nsIFrame * 0x03e1ed64, nsIStyleContext * 0x03cad728, int 0, nsIFrame * 0x03e22eb4, nsIFrame * * 0x00123348, nsIFrame * * 0x00123318) line 12859 + 38 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03a819d0, nsIFrame * 0x03e1ed64, nsIStyleContext * 0x03cad728, nsFrameItems & {...}) line 6606 + 53 bytes nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a819d0, nsIFrame * 0x03e1ed64, nsIAtom * 0x010e9bd0, int 3, nsIStyleContext * 0x03cad728, nsFrameItems & {...}, int 0) line 7394 + 45 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a819d0, nsIFrame * 0x03e1ed64, nsFrameItems & {...}) line 7266 + 56 bytes nsCSSFrameConstructor::ProcessInlineChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a473a0, nsIFrame * 0x03e1ed64, int 1, nsFrameItems & {...}, int * 0x001235a8) line 13074 + 43 bytes nsCSSFrameConstructor::ConstructInline(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03a473a0, nsIFrame * 0x03e1d498, nsIStyleContext * 0x03dc7ff0, int 0, nsIFrame * 0x03e1ed64, nsIFrame * * 0x00123808, nsIFrame * * 0x001237d8) line 12859 + 38 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03a473a0, nsIFrame * 0x03e1d498, nsIStyleContext * 0x03dc7ff0, nsFrameItems & {...}) line 6606 + 53 bytes nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a473a0, nsIFrame * 0x03e1d498, nsIAtom * 0x010e9bd0, int 3, nsIStyleContext * 0x03dc7ff0, nsFrameItems & {...}, int 0) line 7394 + 45 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a473a0, nsIFrame * 0x03e1d498, nsFrameItems & {...}) line 7266 + 56 bytes nsCSSFrameConstructor::ProcessInlineChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a3bc20, nsIFrame * 0x03e1d498, int 1, nsFrameItems & {...}, int * 0x00123a68) line 13074 + 43 bytes nsCSSFrameConstructor::ConstructInline(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03a3bc20, nsIFrame * 0x03e1d120, nsIStyleContext * 0x03dbebf8, int 0, nsIFrame * 0x03e1d498, nsIFrame * * 0x00123cc8, nsIFrame * * 0x00123c98) line 12859 + 38 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x03cfa754, nsIContent * 0x03a3bc20, nsIFrame * 0x03e1d120, nsIStyleContext * 0x03dbebf8, nsFrameItems & {...}) line 6606 + 53 bytes nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a3bc20, nsIFrame * 0x03e1d120, nsIAtom * 0x010e9bd0, int 3, nsIStyleContext * 0x03dbebf8, nsFrameItems & {...}, int 0) line 7394 + 45 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a3bc20, nsIFrame * 0x03e1d120, nsFrameItems & {...}) line 7266 + 56 bytes nsCSSFrameConstructor::ProcessInlineChildren(nsIPresShell * 0x040b18e0, nsIPresContext * 0x0411d200, nsFrameConstructorState & {...}, nsIContent * 0x03a3cd90, nsIFrame * 0x03e1d120, int 1, nsFrameItems & {...}, int * 0x00123f28) line 13074 + 43 bytes nsCSSFrameConstructor::ConstructInline Giving bug to layout.

Harish and I talked, it seems to make more sense to ignore all but the first <title> tags in the body (and, even the first when we do strict DTD parsing). Graciously, Harish has agreed to take this - thanks.

--> 0.9.6

Marc, I see a hang even with my patch! nsQueryInterface::operator()(const nsID & {...}, void * * 0x001201b8) line 43 + 1 byte nsCOMPtr<nsIRuleNode>::assign_from_helper(const nsCOMPtr_helper & {...}, const nsID & {...}) line 986 + 18 bytes nsCOMPtr<nsIRuleNode>::nsCOMPtr<nsIRuleNode>(const nsQueryInterface & {...}) line 580 nsCOMPtr<nsIRuleNode>::Assert_NoQueryNeeded() line 515 nsCOMPtr<nsIRuleNode>::operator=(const already_AddRefed<nsIRuleNode> & {...}) line 609 nsRuleNode::Transition(nsRuleNode * const 0x049dcd60, nsIStyleRule * 0x022d8474, nsIRuleNode * * 0x00120264) line 412 nsRuleWalker::Forward(nsRuleWalker * const 0x03fb6180, nsIStyleRule * 0x022d8474) line 95 + 54 bytes ContentEnumFunc(nsICSSStyleRule * 0x022d8474, void * 0x0012034c) line 3899 RuleHash::EnumerateAllRules(int 3, nsIAtom * 0x0117b6a0, nsIAtom * 0x00000000, const nsVoidArray & {...}, void (nsICSSStyleRule *, void *)* 0x01cbf880 ContentEnumFunc(nsICSSStyleRule *, void *), void * 0x0012034c) line 627 + 28 bytes CSSRuleProcessor::RulesMatching(CSSRuleProcessor * const 0x04457fe0, nsIPresContext * 0x044aa500, nsIAtom * 0x0117fe70, nsIContent * 0x04513390, nsIStyleContext * 0x04a2f4d8, nsIRuleWalker * 0x03fb6180) line 3963 EnumRulesMatching(nsISupports * 0x04457fe0, void * 0x00120464) line 768 nsSupportsArray::EnumerateForwards(nsSupportsArray * const 0x04456ad0, int (nsISupports *, void *)* 0x01c1a3c0 EnumRulesMatching(nsISupports *, void *), void * 0x00120464) line 684 + 20 bytes StyleSetImpl::WalkRuleProcessors(int (nsISupports *, void *)* 0x01c1a3c0 EnumRulesMatching(nsISupports *, void *), void * 0x00120464, nsIContent * 0x04513390) line 1736 StyleSetImpl::ResolveStyleFor(nsIPresContext * 0x044aa500, nsIContent * 0x04513390, nsIStyleContext * 0x04a2f4d8, int 0) line 865 nsPresContext::ResolveStyleContextFor(nsPresContext * const 0x044aa500, nsIContent * 0x04513390, nsIStyleContext * 0x04a2f4d8, int 0, nsIStyleContext * * 0x00120524) line 848 + 38 bytes nsCSSFrameConstructor::ResolveStyleContext(nsIPresContext * 0x044aa500, nsIFrame * 0x04b4cbfc, nsIContent * 0x04513390, nsIAtom * 0x0117b6a0, nsIStyleContext * * 0x00120524) line 6520 + 31 bytes nsCSSFrameConstructor::ConstructFrame(nsIPresShell * 0x044a21b0, nsIPresContext * 0x044aa500, nsFrameConstructorState & {...}, nsIContent * 0x04513390, nsIFrame * 0x04b4cbfc, nsFrameItems & {...}) line 6896 + 53 bytes nsCSSFrameConstructor::ProcessInlineChildren(nsIPresShell * 0x044a21b0, nsIPresContext * 0x044aa500, nsFrameConstructorState & {...}, nsIContent * 0x04517ca0, nsIFrame * 0x04b4cbfc, int 1, nsFrameItems & {...}, int * 0x00120690) line 12905 + 69 bytes nsCSSFrameConstructor::ConstructInline(nsIPresShell * 0x044a21b0, nsIPresContext * 0x044aa500, nsFrameConstructorState & {...}, const nsStyleDisplay * 0x049e2944, nsIContent * 0x04517ca0, nsIFrame * 0x04b48f2c, nsIStyleContext * 0x04a2f4d8, int 0, nsIFrame * 0x04b4cbfc, nsIFrame * * 0x00120a10, nsIFrame * * 0x001209e0) line 12689 + 38 bytes nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell * 0x044a21b0,

Looks like a crash in style

Bugzilla is acting weird, Edit attachment does not work... Anyway, r=heikki on v1.0. I would recommend changing the flag name to NS_PARSER_FLAG_HAS_TITLE.

*** Bug 105621 has been marked as a duplicate of this bug. ***

out of time :( --> 0.9.7

Don't understand why we crash even after ignoring all but first TITLE. Marc, could you take a look? Thanx.

I have a sneaky feeling it isn't the title tags, I tried a little test with 10 title tags in the body and it did not crash. So, I will try and get this one reduced down to the minimal for you guys.

I am seeing a problem with invalid markup on this page. Specifically, there are some SPAN elements that contain P or DIV elements, and that is illegal (in addition to causing us problems in our frame model!). These all have the class 'smaller' so I added a style rule span.smaller { display: block; } to make those spans block elements instead of inline elements. This fixes the hang. The stack I am seeing has the same pattern I have seen elsewhere: nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x03a8cbd0, nsIFrame * 0x04131054) line 13481 nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x04526040, nsIContent * 0x04528e20, int 14) line 9186 + 16 bytes nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x04526040, nsIContent * 0x04528e20, nsIContent * 0x04528e20, int 14) line 8820 + 28 bytes nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x03a8cbd0, nsIFrame * 0x04132fcc) line 13511 + 47 bytes nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x04528e20, nsIContent * 0x0452b280, int 15) line 9186 + 16 bytes nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x04528e20, nsIContent * 0x0452b280, nsIContent * 0x0452b280, int 15) line 8820 + 28 bytes nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x03a8cbd0, nsIFrame * 0x04133a7c) line 13511 + 47 bytes nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x0452b280, nsIContent * 0x0452dea0, int 10) line 9186 + 16 bytes nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x0452b280, nsIContent * 0x0452dea0, nsIContent * 0x0452dea0, int 10) line 8820 + 28 bytes nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x03a8cbd0, nsIFrame * 0x04136d90) line 13511 + 47 bytes nsCSSFrameConstructor::ContentRemoved(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x0452dea0, nsIContent * 0x045324d0, int 10) line 9186 + 16 bytes nsCSSFrameConstructor::ContentReplaced(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x0452dea0, nsIContent * 0x045324d0, nsIContent * 0x045324d0, int 10) line 8820 + 28 bytes nsCSSFrameConstructor::ReframeContainingBlock(nsIPresContext * 0x03a8cbd0, nsIFrame * 0x0413a188) line 13511 + 47 bytes nsCSSFrameConstructor::ContentAppended(nsCSSFrameConstructor * const 0x03db8750, nsIPresContext * 0x03a8cbd0, nsIContent * 0x04538fc0, int 3) line 7997 + 19 bytes StyleSetImpl::ContentAppended(StyleSetImpl * const 0x03db8820, nsIPresContext * 0x03a8cbd0, nsIContent * 0x04538fc0, int 3) line 1412 PresShell::ContentAppended(PresShell * const 0x03db8318, nsIDocument * 0x03b3e450, nsIContent * 0x04538fc0, int 3) line 5111 + 49 bytes nsDocument::ContentAppended(nsDocument * const 0x03b3e450, nsIContent * 0x04538fc0, int 3) line 1684 nsHTMLDocument::ContentAppended(nsHTMLDocument * const 0x03b3e450, nsIContent * 0x04538fc0, int 3) line 1127 + 17 bytes I think that we are blowing it when we have a block in an inline and content is appended to a sibling of the inline. We have similar problems in bug 56894 and bug 97874 - same stack and same markup issue. Changing summary since I think this has nothing to do with the TITLE tag and is fixed by making the offensive SPAN elements blocks.

no test case necessary, Marc debugged

Patch in bug 56894 fixes this - marking as a dup *** This bug has been marked as a duplicate of 56894 ***

Marking Verified Duplicate -