Here's the stack trace: NTDLL! 77f76148() nsDebug::PreCondition(const char * 0x0077e9b4, const char * 0x0077e99c, const char * 0x0077e974, int 39) line 112 + 13 bytes LocationImpl::AddRef(LocationImpl * const 0x00fa8fe0) line 39 + 35 bytes GlobalWindowImpl::GetLocation(GlobalWindowImpl * const 0x015bd700, nsIDOMLocation * * 0x0012ef00) line 384 + 27 bytes GlobalWindowImpl::SetProperty(JSContext * 0x00f7c720, long 17799036, long * 0x0012f848) line 1711 + 29 bytes nsJSUtils::nsCallJSScriptObjectSetProperty(nsISupports * 0x015bd708, JSContext * 0x00f7c720, long 17799036, long * 0x0012f848) line 113 + 23 bytes SetWindowProperty(JSContext * 0x00f7c720, JSObject * 0x010f9780, long 17799036, long * 0x0012f848) line 553 + 21 bytes js_SetProperty(JSContext * 0x00f7c720, JSObject * 0x010f9780, long 22779072, long * 0x0012f848) line 1914 + 25 bytes js_Interpret(JSContext * 0x00f7c720, long * 0x0012f9ac) line 2160 + 806 bytes js_Execute(JSContext * 0x00f7c720, JSObject * 0x010f8520, JSScript * 0x015b93e0, JSFunction * 0x00000000, JSStackFrame * 0x00000000, int 0, long * 0x0012f9ac) line 815 + 13 bytes JS_EvaluateUCScriptForPrincipals(JSContext * 0x00f7c720, JSObject * 0x010f8520, JSPrincipals * 0x00000000, const unsigned short * 0x015b9ce0, unsigned int 305, const char * 0x015ebf00, unsigned int 36, long * 0x0012f9ac) line 2323 + 27 bytes nsJSContext::EvaluateString(nsJSContext * const 0x00f7c890, const nsString & {" <!-- var popupURL = "http://www.mp3.com/music/dummypopup.html"; var popup = window.open(popupURL,"PlatinumCD",'toolbar=0,loca"}, const char * 0x015ebf00, unsigned int 36, nsString & {""}, int * 0x0012f9d8) line 91 + 64 bytes HTMLContentSink::EvaluateScript(nsString & {" <!-- var popupURL = "http://www.mp3.com/music/dummypopup.html"; var popup = window.open(popupURL,"PlatinumCD",'toolbar=0,loca"}, int 36) line 2711 + 32 bytes HTMLContentSink::ProcessSCRIPTTag(const nsIParserNode & {...}) line 2820 HTMLContentSink::AddLeaf(HTMLContentSink * const 0x015edf30, const nsIParserNode & {...}) line 1926 + 12 bytes CNavDTD::AddLeaf(const nsIParserNode & {...}) line 2429 + 31 bytes CNavDTD::HandleScriptToken(nsCParserNode & {...}) line 1279 + 12 bytes CNavDTD::OpenContainer(const nsIParserNode & {...}, int 1) line 2259 + 12 bytes CNavDTD::HandleDefaultStartToken(CToken * 0x00fbd3b0, nsHTMLTag eHTMLTag_script, nsIParserNode & {...}) line 887 + 17 bytes CNavDTD::HandleStartToken(CToken * 0x00fbd3b0) line 995 + 23 bytes NavDispatchTokenHandler(CToken * 0x00fbd3b0, nsIDTD * 0x0159c2f0) line 250 + 12 bytes CTokenHandler::operator()(CToken * 0x00fbd3b0, nsIDTD * 0x0159c2f0) line 80 + 14 bytes CNavDTD::HandleToken(CNavDTD * const 0x0159c2f0, CToken * 0x00fbd3b0, nsIParser * 0x015ec0c0) line 577 + 18 bytes CNavDTD::BuildModel(CNavDTD * const 0x0159c2f0, nsIParser * 0x015ec0c0, nsITokenizer * 0x0159dfd0, nsITokenObserver * 0x00000000, nsIContentSink * 0x015edf30) line 507 + 20 bytes nsParser::BuildModel() line 753 + 34 bytes nsParser::ResumeParse(nsIDTD * 0x00000000) line 707 + 11 bytes nsParser::OnDataAvailable(nsParser * const 0x015ec0c4, nsIURL * 0x015e8770, nsIInputStream * 0x015ecc20, unsigned int 4096) line 917 + 17 bytes nsDocumentBindInfo::OnDataAvailable(nsDocumentBindInfo * const 0x015e9310, nsIURL * 0x015e8770, nsIInputStream * 0x015ecc20, unsigned int 4096) line 1711 + 24 bytes OnDataAvailableProxyEvent::HandleEvent(OnDataAvailableProxyEvent * const 0x0159c7b0) line 635 StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x0159c7b4) line 474 + 12 bytes PL_HandleEvent(PLEvent * 0x0159c7b4) line 395 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x00ef02d0) line 357 + 9 bytes _md_EventReceiverProc(HWND__ * 0x0001048a, unsigned int 49304, unsigned int 0, long 15663824) line 675 + 9 bytes USER32! 77e71250() 00ef02d0()

Missing NS_INIT_REFCNT() in nsLocation.cpp. Fixed on 2/4/1999.

checked on win95, no crash -- Christopher please verify on winNT -- thanks

No crash under NT, but the pop-up window isn't drawn at the right size (text is clipped). Verified fixed, Feb-09 build.