Any javascript: url is crashing for me now, with the following stack: 00000000 PPC 1F3B6C34 08B21B00 PPC 1F3A1630 main+00240 08B21A60 PPC 1F39FC14 main1(int, char**, nsISplashScreen*)+00810 08B21960 PPC 1E521A60 nsAppShellService::Run()+00054 08B21910 PPC 1E3F5048 nsAppShell::Run()+00040 08B218D0 PPC 1E3F58F8 nsMacMessagePump::DoMessagePump()+00044 08B21880 PPC 1E3F5FE8 nsMacMessagePump::DispatchEvent(int, EventRecord*)+ 001B0 08B21830 PPC 1F41FA24 Repeater::DoRepeaters(const EventRecord&)+0003C 08B217E0 PPC 1E3CEE70 nsMacNSPREventQueueHandler::RepeatAction(const EventRecord&)+00014 08B217A0 PPC 1E3CF14C nsMacNSPREventQueueHandler::ProcessPLEventQueue()+ 00274 08B21710 PPC 1CD25B7C nsEventQueueImpl::ProcessPendingEvents()+00068 08B216A0 PPC 1CD9C890 PL_ProcessPendingEvents+00084 08B21650 PPC 1CD9C9D4 PL_HandleEvent+00054 08B21610 PPC 1CA05610 nsStreamListenerEvent::HandlePLEvent(PLEvent*)+00050 08B215D0 PPC 1CA06CBC nsGetServiceByCID::~nsGetServiceByCID()+00708 08B21580 PPC 1CA33BD0 nsStreamIOChannel::OnStopRequest(nsIChannel*, nsISupports*, unsigned int, const unsigned short*)+000DC The nsStreamIOChannel in that last stack frame has been deleted already.

This is a blocker.

*** Bug 35769 has been marked as a duplicate of this bug. ***

The above "duplicate" (bug 35769) has a different stack trace, but it also started with today's build. Please try to verify it also when this bug is fixed.

Refcounting bug in the js protocol. Fixed.

Adding crash keyword

verified: Mac8.6 2000041810 NT 2000042009 Linux 2000042609