do not allow the stream listener to be freed during a call to OnDataAvailable... It is possible, that OnStopBinding() wil lbe called while the listener is processing the data (ie. the URL load is interrupted). If this happens, do not free the listener until the OnDataAvailable() call has finished...

uriloader/base/nsDocLoader.cpp

@@ -1348,7 +1348,19 @@ NS_METHOD nsDocumentBindInfo::OnDataAvailable(nsIURL* aURL,
 
     NS_PRECONDITION(nsnull !=m_NextStream, "DocLoader: No stream for document");
     if (nsnull != m_NextStream) {
-        rv = m_NextStream->OnDataAvailable(aURL, aStream, aLength);
+       /*
+        * Bump the refcount in case the stream gets destroyed while the data
+        * is being processed...  If Stop(...) is called the stream could be
+        * freed prematurely :-(
+        *
+        * Currently this can happen if javascript loads a new URL 
+        * (via nsIWebShell::LoadURL) during the parse phase... 
+        */
+        nsIStreamListener* listener = m_NextStream;
+
+        NS_ADDREF(listener);
+        rv = listener->OnDataAvailable(aURL, aStream, aLength);
+        NS_RELEASE(listener);
     }
 
 done:

webshell/src/nsDocLoader.cpp

@@ -1348,7 +1348,19 @@ NS_METHOD nsDocumentBindInfo::OnDataAvailable(nsIURL* aURL,
 
     NS_PRECONDITION(nsnull !=m_NextStream, "DocLoader: No stream for document");
     if (nsnull != m_NextStream) {
-        rv = m_NextStream->OnDataAvailable(aURL, aStream, aLength);
+       /*
+        * Bump the refcount in case the stream gets destroyed while the data
+        * is being processed...  If Stop(...) is called the stream could be
+        * freed prematurely :-(
+        *
+        * Currently this can happen if javascript loads a new URL 
+        * (via nsIWebShell::LoadURL) during the parse phase... 
+        */
+        nsIStreamListener* listener = m_NextStream;
+
+        NS_ADDREF(listener);
+        rv = listener->OnDataAvailable(aURL, aStream, aLength);
+        NS_RELEASE(listener);
     }
 
 done: