Accessing this URL crashes Netscape 6. http://www.elkhart.lib.in.us/webpac-bin/wgbroker?new+-access+top.dynix Stack Trace : Incident ID 9212475 0x00000009 nsBlockFrame::QueryInterface [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1194] nsLineBox::DeleteLineList [d:\builds\seamonkey\mozilla\layout\html\base\src\nsLineBox.cpp, line 252] nsBlockFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 1179] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98] nsTableFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 251] nsFrameList::DestroyFrames [d:\builds\seamonkey\mozilla\layout\base\src\nsFrameList.cpp, line 36] nsContainerFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\base\src\nsContainerFrame.cpp, line 98] nsTableOuterFrame::Destroy [d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableOuterFrame.cpp, line 63] nsBlockFrame::DoRemoveFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5241] nsBlockFrame::RemoveFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsBlockFrame.cpp, line 5142] nsFormFrame::RemoveFrame [d:\builds\seamonkey\mozilla\layout\html\forms\src\nsFormFrame.cpp, line 360] FrameManager::RemoveFrame [d:\builds\seamonkey\mozilla\layout\html\base\src\nsFrameManager.cpp, line 633] nsCSSFrameConstructor::ContentRemoved [d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, line 8799] StyleSetImpl::ContentRemoved [d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp, line 1047] PresShell::ContentRemoved [d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2846] nsDocument::ContentRemoved [d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1721] nsHTMLDocument::ContentRemoved [d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 1154] nsGenericHTMLContainerElement::RemoveChildAt [d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, line 3158] nsHTMLSelectElement::RemoveChildAt [d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLSelectElement.cpp, line 178] SinkContext::DemoteContainer [d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, line 1586] HTMLContentSink::CloseForm [d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, line 2826] CNavDTD::CloseForm [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 2692] CNavDTD::CloseContainer [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 2956] CNavDTD::HandleEndToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1544] CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 709] CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 452] nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1219] nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1104] nsParser::OnDataAvailable [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line 1541]

Looks like block code

Adding the keyword 'topcrash' and including URL

Adding chofmann to cclist.

rod, I think this one might be yours. Look at the test case I'm about to attach (the second test case.) It's a select followed by a <p>, pretty simple stuff. cc'd rickg and harish, because it seems wrong that we're calling DemoteContainer for this test case. Could one of you pleaes verify that the parser and content sink are doing the right thing with this well-formed test case? simplified stack: nsLineBox::DeleteLineList() line 251 nsBlockFrame::Destroy() line 1177 + 16 bytes nsAreaFrame::Destroy() line 70 nsComboboxControlFrame::Destroy() line 2260 nsBlockFrame::DoRemoveFrame() line 5240 nsBlockFrame::RemoveFrame() line 5138 + 16 bytes nsFormFrame::RemoveFrame() line 360 FrameManager::RemoveFrame() line 633 nsCSSFrameConstructor::ContentRemoved() line 8793 + 63 bytes StyleSetImpl::ContentRemoved() line 1047 PresShell::ContentRemoved() line 2746 + 50 bytes nsDocument::ContentRemoved() line 1720 nsHTMLDocument::ContentRemoved() line 1154 nsGenericHTMLContainerElement::RemoveChildAt() line 3158 nsHTMLFormElement::RemoveChildAt() line 93 + 22 bytes SinkContext::DemoteContainer() line 1576 + 18 bytes HTMLContentSink::CloseForm() line 2824 + 18 bytes CNavDTD::CloseForm() line 2687 + 31 bytes CNavDTD::CloseContainer() line 2955 + 12 bytes CNavDTD::HandleEndToken() line 1543 + 21 bytes CNavDTD::HandleToken() line 712 + 12 bytes CNavDTD::BuildModel() line 447 + 20 bytes nsParser::BuildModel() line 1218 + 34 bytes nsParser::ResumeParse() line 1102 + 11 bytes nsParser::OnDataAvailable() line 1536 + 19 bytes nsDocumentOpenInfo::OnDataAvailable() line 269 + 46 bytes nsFileChannel::OnDataAvailable() line 651 + 49 bytes nsOnDataAvailableEvent::HandleEvent() line 406 + 47 bytes nsStreamListenerEvent::HandlePLEvent() line 97 + 12 bytes PL_HandleEvent() line 575 + 10 bytes PL_ProcessPendingEvents() line 520 + 9 bytes

Adding crash keyword.

This is a dup of my bug. I will be checking in a fix tomorrow (hopefully). *** This bug has been marked as a duplicate of 36558 ***

I guess I should have said I just tested it with my fix and it loaded fine.

Marking verified dup of 36558.