Cited page crashes during parsing with this stack frame: NTDLL! 77f76274() nsDebug::PreCondition(char * 0x0073123c, char * 0x00731218, char * 0x007311e4, int 190) line 110 + 13 bytes nsDTDContext::Push(nsHTMLTag eHTMLTag_a) line 190 + 42 bytes CNavDTD::OpenContainer(const nsIParserNode & {...}, int 1) line 2139 CNavDTD::HandleDefaultStartToken(CToken * 0x013adcd0, nsHTMLTag eHTMLTag_a, nsIParserNode & {...}) line 781 + 14 bytes CNavDTD::HandleStartToken(CToken * 0x013adcd0) line 874 + 23 bytes NavDispatchTokenHandler(CToken * 0x013adcd0, nsIDTD * 0x013aac90) line 261 + 12 bytes CTokenHandler::operator()(CToken * 0x013adcd0, nsIDTD * 0x013aac90) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x013aac90, CToken * 0x013adcd0, nsIParser * 0x0132be60) line 550 + 18 bytes CNavDTD::BuildModel(CNavDTD * const 0x013aac90, nsIParser * 0x0132be60, nsITokenizer * 0x013ab1e0) line 478 + 20 bytes nsParser::BuildModel() line 718 + 20 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 672 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x0132be64, nsIURL * 0x0132f3f0, nsIInputStream * 0x0134a630, unsigned int 4045) line 868 + 17 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x0132f370, nsIURL * 0x0132f3f0, nsIInputStream * 0x0134a630, unsigned int 4045) line 1705 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x013e6a80) line 624 + 45 bytes StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x013e6a84) line 464 + 12 bytes PL_HandleEvent(PLEvent * 0x013e6a84) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x0121f1f0) line 357 + 9 bytes _md_EventReceiverProc(void * 0x00020690, unsigned int 49289, unsigned int 0, long 19001840) line 675 + 9 bytes USER32! 77e71268() 0121f1f0()

Fixed by improvements to new DTD system; also fixed one in comment parsing.

Verified that this page doesn't crash, using the 1.28.99 builds on Win32, Mac OS & Linux. Michael, please re-open if you believe there may still be a problem.