code current as of Sunday 11/22/98 12:30pm. line: NS_ASSERTION(nsnull != aReflowState.lineLayout, "no line layout"); stack: nsDebug::Assertion(char * 0x006984fc, char * 0x006984d8, char * 0x006984a4, int 547) line 95 + 13 bytes nsInlineFrame::Reflow(nsInlineFrame * const 0x02302564, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 547 + 39 bytes nsContainerFrame::ReflowChild(nsIFrame * 0x02302560, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 410 + 28 bytes RootFrame::Reflow(RootFrame * const 0x02302f54, nsIPresContext & {...}, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, unsigned int & 0) line 217 PresShell::InitialReflow(PresShell * const 0x022f6b30, int 11505, int 12045) line 527 HTMLContentSink::StartLayout() line 1810 HTMLContentSink::OpenBody(HTMLContentSink * const 0x022b5600, const nsIParserNode & {...}) line 1557 CNavDTD::OpenBody(const nsIParserNode & {...}) line 2609 + 28 bytes CNavDTD::OpenContainer(const nsIParserNode & {...}, int 1) line 2750 + 12 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x012b4a50, nsHTMLTag eHTMLTag_body, nsIParserNode & {...}) line 832 + 14 bytes CNavDTD::HandleStartToken(CToken * 0x012b4a50) line 919 + 23 bytes NavDispatchTokenHandler(CToken * 0x012b4a50, nsIDTD * 0x022f8ba0) line 442 + 12 bytes CTokenHandler::operator()(CToken * 0x012b4a50, nsIDTD * 0x022f8ba0) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x022f8ba0, CToken * 0x012b4a50) line 686 + 18 bytes nsParser::BuildModel() line 708 + 16 bytes nsParser::ResumeParse() line 673 nsParser::OnDataAvailable(nsParser * const 0x022b5ea4, nsIURL * 0x022a8c60, nsIInputStream * 0x022adfc0, int 4019) line 906 + 15 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x022a8ba0, nsIURL * 0x022a8c60, nsIInputStream * 0x022adfc0, int 4019) line 1460 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x022f8ac0) line 606 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x022f8ac4) line 452 + 12 bytes PL_HandleEvent(PLEvent * 0x022f8ac4) line 408 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x01218fc0) line 370 + 9 bytes

The parser is losing it's mind on this one because at the top of the document is a "DOCTYPE" tag (not a !DOCTYPE tag!!!). If you stick a "!" in front of DOCTYPE the crash goes away. The content model trace looks like this (showing the bogus call to OpenContainer for DOCTYPE): 0[1202960]: HTMLContentSink::Init: this=124f930 url='http://www.as.org/' 0[1202960]: HTMLContentSink::WillResume: this=124f930 0[1202960]: HTMLContentSink::OpenHTML: this=124f930 node='HTML' 0[1202960]: SinkContext::OpenContainer: this=1250560 node='DOCTYPE' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: HTMLContentSink::OpenHead: this=124f930 node='TITLE' 0[1202960]: HTMLContentSink::CloseHead: this=124f930 node='TITLE' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: HTMLContentSink::OpenHead: this=124f930 node='META' 0[1202960]: HTMLContentSink::CloseHead: this=124f930 node='META' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: HTMLContentSink::OpenHead: this=124f930 node='META' 0[1202960]: HTMLContentSink::CloseHead: this=124f930 node='META' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: HTMLContentSink::OpenHead: this=124f930 node='META' 0[1202960]: HTMLContentSink::CloseHead: this=124f930 node='META' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: HTMLContentSink::OpenHead: this=124f930 node='META' 0[1202960]: HTMLContentSink::CloseHead: this=124f930 node='META' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: HTMLContentSink::OpenHead: this=124f930 node='BASE' 0[1202960]: HTMLContentSink::CloseHead: this=124f930 node='BASE' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' : ' 0[1202960]: SinkContext::AddLeaf: this=1250560 node=' ' 0[1202960]: SinkContext::CloseContainer: this=1250560 node='' 0[1202960]: HTMLContentSink::OpenBody: this=124f930 node='BODY' 0[1202960]: SinkContext::OpenContainer: this=1250560 node='BODY'

Kipp: I can't repro this in NT/debug build. Please verify and close.

Rick fixed it with his parser changes...

Putting on ss: radar for a Verification by QA.

*** Bug 1527 has been marked as a duplicate of this bug. ***

works for me on 11/24 build.

Inserting Milestone info.