Stack trace on the 2/9/99 build: nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x013034d0, nsIPresContext & {...}) line 430 + 19 bytes nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x013269b0) line 228 nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x01303c40, nsIPresContext & {...}) line 422 + 16 bytes nsAreaFrame::DeleteFrame(nsAreaFrame * const 0x01303c40, nsIPresContext & {...}) line 96 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01303b50, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x013038c0, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x013035f0, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01303120, nsIPresContext & {...}) line 81 nsTableFrame::DeleteFrame(nsTableFrame * const 0x01303120, nsIPresContext & {...}) line 322 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01302960, nsIPresContext & {...}) line 81 nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x013102d0) line 228 nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x01310120, nsIPresContext & {...}) line 422 + 16 bytes nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsInlineFrame::DeleteFrame(nsInlineFrame * const 0x013367d0, nsIPresContext & {...}) line 321 nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x01310520) line 228 nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x012fc210, nsIPresContext & {...}) line 422 + 16 bytes nsAreaFrame::DeleteFrame(nsAreaFrame * const 0x012fc210, nsIPresContext & {...}) line 96 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012fc120, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012957c0, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x01295d00, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x014552b0, nsIPresContext & {...}) line 81 nsTableFrame::DeleteFrame(nsTableFrame * const 0x014552b0, nsIPresContext & {...}) line 322 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x0144e280, nsIPresContext & {...}) line 81 nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x0136f5b0) line 228 nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x01469f80, nsIPresContext & {...}) line 422 + 16 bytes nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x012f8d00) line 228 nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x012c3ac0, nsIPresContext & {...}) line 422 + 16 bytes nsLineBox::DeleteLineList(nsIPresContext & {...}, nsLineBox * 0x012c3f90) line 228 nsBlockFrame::DeleteFrame(nsBlockFrame * const 0x012c3620, nsIPresContext & {...}) line 422 + 16 bytes nsAreaFrame::DeleteFrame(nsAreaFrame * const 0x012c3620, nsIPresContext & {...}) line 96 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012c3210, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012be1a0, nsIPresContext & {...}) line 81 nsFrameList::DeleteFrames(nsIPresContext & {...}) line 30 nsContainerFrame::DeleteFrame(nsContainerFrame * const 0x012bee90, nsIPresContext & {...}) line 81 ViewportFrame::DeleteFrame(ViewportFrame * const 0x012bee90, nsIPresContext & {...}) line 102 PresShell::~PresShell() line 444 PresShell::`scalar deleting destructor'(unsigned int 1) + 15 bytes PresShell::Release(PresShell * const 0x012b9120) line 390 + 28 bytes DocumentViewerImpl::~DocumentViewerImpl() line 219 + 18 bytes DocumentViewerImpl::`scalar deleting destructor'(unsigned int 1) + 15 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x014715d0) line 156 + 99 bytes nsWebShell::Embed(nsWebShell * const 0x012364b0, nsIContentViewer * 0x01348eb0, char * 0x00000000, nsISupports * 0x00000000) line 648 + 27 bytes nsDocumentBindInfo::OnStartBinding(nsDocumentBindInfo * const 0x013463d0, nsIURL * 0x01346420, char * 0x01347ed0) line 1645 + 36 bytes OnStartBindingProxyEvent::HandleEvent(OnStartBindingProxyEvent * const 0x01347e80) line 509 StreamListenerProxyEvent::HandlePLEvent(PLEvent * 0x01347e84) line 474 + 12 bytes PL_HandleEvent(PLEvent * 0x01347e84) line 472 + 10 bytes PL_ProcessPendingEvents(PLEventQueue * 0x011f4720) line 433 + 9 bytes _md_EventReceiverProc(void * 0x029e0260, unsigned int 49340, unsigned int 0, long 18827040) line 784 + 9 bytes USER32! 77e713ed() Crash occurs because the mBullet member variable of nsBlockFrame is dereferenced after it has been freed.

Fixing typo in summary...

OK, more investigation reveals that we crash any time we go to a new page from Netscape's home page, www.netscape.com. Changing URL and summary to reflect that.

Troy fixed this bug for me - I merged to DeleteFrame methods and got the code into the wrong order...

verified fixed, you can go to other pages after going to www.netscape.com