Id: AVR:Free microsoftedgecp.exe!EDGEHTML.dll!CMarkup::EnsureDeleteCFState 7C0A0A
Description: Access violation while reading memory at 0xF050FFC using a pointer to freed memory
Process binary: microsoftedgecp.exe
Location: EDGEHTML.dll!CMarkup::EnsureDeleteCFState + 0xD
Security impact: Potentially exploitable security issue
EDGEHTML.dll!CMarkup::EnsureDeleteCFState + 0xD (7C in id)
EDGEHTML.dll!Tree::FirstLetterBuilder::ComputeFirstLetterFormats + 0x1CC (7C0A in id)
EDGEHTML.dll!Tree::FirstLetterBuilder::ComputeFirstLetterFormats + 0x96 (7C0A0A in id)
EDGEHTML.dll!CGeneratedElement::ComputeFormats + 0x354DF6 (this symbol may not be correct)
EDGEHTML.dll!CTreeNode::ComputeFormats + 0x287
EDGEHTML.dll!CTreeNode::ComputeFormatsHelper + 0x48
EDGEHTML.dll!Layout::ContentReader::GetNearestBlockLevelAncestor + 0x32C793 (this symbol may not be correct)
EDGEHTML.dll!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree + 0xBF
EDGEHTML.dll!Tree::ElementNode::CreateWrapperElement + 0x20
EDGEHTML.dll!Tree::FirstLetterBuilder::CreateFirstLetterContainer + 0xC1
EDGEHTML.dll!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers + 0x58
EDGEHTML.dll!Tree::FirstLetterBuilder::EnsureFirstLetterElement + 0x32F0C7 (this symbol may not be correct)
EDGEHTML.dll!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock + 0xC3
EDGEHTML.dll!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer + 0x117
EDGEHTML.dll!Tree::FirstLetterBuilder::EnsureFirstLetterElement + 0x32F096 (this symbol may not be correct)
EDGEHTML.dll!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock + 0xC3
EDGEHTML.dll!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask + 0x59
EDGEHTML.dll!Layout::FlowBoxBuilder::MoveToNextPosition + 0x117
EDGEHTML.dll!Layout::LayoutBuilderDriver::BuildPageLayout + 0x4CD
... (rest of the stack was ignored)
Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Image name: microsoftedgecp.exe
Timestamp: Thu Jul 09 20:23:10 2015 (559F3A9E)
CheckSum: 00056441
ImageSize: 0004B000
File version: 11.0.10240.16384
Product version: 11.0.10240.16384
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Edge
InternalName: MicrosoftEdgeCP
OriginalFilename: MicrosoftEdgeCP.exe
ProductVersion: 11.00.10240.16384
FileVersion: 11.00.10240.16384 (th1.150709-1700)
FileDescription: Microsoft Edge Content Process
LegalCopyright: � Microsoft Corporation. All rights reserved.
address 0f050ffc found in
_DPH_HEAP_ROOT @ 4e01000
in free-ed allocation ( DPH_HEAP_BLOCK: VirtAddr VirtSize)
ef42d9c: f050000 2000
6e0b9cd2 verifier!AVrfDebugPageHeapFree+0x000000c2
77eb2e20 ntdll!RtlDebugFreeHeap+0x0000003c
77e6e0da ntdll!RtlpFreeHeap+0x0006c97a
77e65d2c ntdll!RtlpFreeHeapInternal+0x0000027e
77e00a3c ntdll!RtlFreeHeap+0x0000002c
62658b1d EDGEHTML!MemoryProtection::HeapFree+0x0000004d
62f060c3 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x000001cc
62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
6258a5b0 EDGEHTML!CTreeNode::CacheStyleForLayout+0x00000030
62f06077 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000180
62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
62950cd3 EDGEHTML!Layout::ContentReader::GetNearestBlockLevelAncestor+0x0032c793
625e2ded EDGEHTML!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree+0x000000bf
624d119b EDGEHTML!Tree::ElementNode::CreateWrapperElement+0x00000020
62f061e0 EDGEHTML!Tree::FirstLetterBuilder::CreateFirstLetterContainer+0x000000c1
62efd418 EDGEHTML!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers+0x00000058
6294f6e7 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f0c7
626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
62efd59f EDGEHTML!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer+0x00000117
6294f6b6 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f096
626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
62627c79 EDGEHTML!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask+0x00000059
626273e7 EDGEHTML!Layout::FlowBoxBuilder::MoveToNextPosition+0x00000117
62626d1d EDGEHTML!Layout::LayoutBuilderDriver::BuildPageLayout+0x000004cd
624f0201 EDGEHTML!Layout::PageCollection::FormatPage+0x0000010e
62520c1d EDGEHTML!Layout::PageCollection::LayoutPagesCore+0x0000026d
Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00c30000 01054000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
ModLoad: 77dd0000 77f49000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000 C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 73ad0000 73b61000 C:\Windows\system32\apphelp.dll
ModLoad: 75aa0000 75b1b000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 77a80000 77b3e000 C:\Windows\system32\msvcrt.dll
ModLoad: 77520000 77563000 C:\Windows\system32\sechost.dll
ModLoad: 77b50000 77c12000 C:\Windows\system32\RPCRT4.dll
ModLoad: 75dd0000 75eba000 C:\Windows\system32\ole32.dll
ModLoad: 758b0000 75a6a000 C:\Windows\system32\combase.dll
ModLoad: 77610000 77765000 C:\Windows\system32\GDI32.dll
ModLoad: 77940000 77a74000 C:\Windows\system32\USER32.dll
ModLoad: 738f0000 73939000 C:\Windows\SYSTEM32\wincorlib.DLL
ModLoad: 75b40000 75bd2000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 75a70000 75a9f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 74f30000 74f3c000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74da0000 74df9000 C:\Windows\SYSTEM32\bcryptPrimitives.dll
ModLoad: 748f0000 74903000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000 C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 6ef00000 6fb72000 C:\Windows\System32\Windows.UI.Xaml.dll
ModLoad: 71c90000 71d55000 C:\Windows\SYSTEM32\wintypes.dll
ModLoad: 733d0000 73461000 C:\Windows\SYSTEM32\CoreMessaging.dll
ModLoad: 73100000 7314d000 C:\Windows\SYSTEM32\NInput.dll
ModLoad: 6ebb0000 6ee71000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 77490000 7751d000 C:\Windows\system32\shcore.dll
ModLoad: 73810000 73861000 C:\Windows\SYSTEM32\Bcp47Langs.dll
ModLoad: 745d0000 745ff000 C:\Windows\system32\rsaenh.dll
ModLoad: 74a00000 74a0a000 C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 73cf0000 73dac000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 746a0000 746b9000 C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 74f40000 74f4f000 C:\Windows\system32\profapi.dll
ModLoad: 73890000 738a3000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 67cd0000 680e0000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eModel.dll
ModLoad: 77290000 772d4000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 75ed0000 7728e000 C:\Windows\system32\SHELL32.dll
ModLoad: 74fa0000 7547c000 C:\Windows\system32\windows.storage.dll
ModLoad: 74f50000 74f94000 C:\Windows\system32\powrprof.dll
ModLoad: 75600000 75636000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 73f20000 73f7d000 C:\Windows\SYSTEM32\firewallapi.dll
ModLoad: 73ef0000 73f1d000 C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 6d510000 6d717000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 73c20000 73c99000 C:\Windows\system32\uxtheme.dll
ModLoad: 730e0000 730fd000 C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 6cb40000 6ccf0000 C:\Windows\system32\CoreUIComponents.dll
ModLoad: 70210000 7028e000 C:\Windows\SYSTEM32\dxgi.dll
ModLoad: 70290000 704a3000 C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 69d80000 69da9000 C:\Windows\System32\Windows.ApplicationModel.dll
ModLoad: 6e6f0000 6e908000 C:\Windows\SYSTEM32\d3d10warp.dll
ModLoad: 6b6f0000 6bb78000 C:\Windows\SYSTEM32\d2d1.dll
ModLoad: 67a30000 67cc4000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eView.dll
ModLoad: 6dcd0000 6de30000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 73150000 731f8000 C:\Windows\System32\dcomp.dll
ModLoad: 6fb80000 6fc4b000 C:\Windows\System32\MrmCoreR.dll
ModLoad: 72e90000 72f05000 C:\Windows\System32\Windows.UI.dll
ModLoad: 6d2c0000 6d2ff000 C:\Windows\system32\DataExchange.dll
ModLoad: 6df50000 6df61000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 744a0000 744c8000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 6ccf0000 6cf14000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 74bb0000 74bd4000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 736b0000 737f2000 C:\Windows\SYSTEM32\PROPSYS.dll
ModLoad: 70990000 709bf000 C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 70920000 70985000 C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 71aa0000 71acd000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 75bf0000 75c4c000 C:\Windows\system32\WS2_32.dll
ModLoad: 75be0000 75be7000 C:\Windows\system32\NSI.dll
ModLoad: 70ca0000 70cb1000 C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 72990000 729c0000 C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 72970000 72978000 C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 71f20000 71fc7000 C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 748a0000 748f0000 C:\Windows\system32\mswsock.dll
ModLoad: 72fe0000 72fef000 C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll
ModLoad: 6cf50000 6cf5c000 C:\Windows\system32\execmodelproxy.dll
ModLoad: 678b0000 67a22000 C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 6bea0000 6c090000 C:\Windows\SYSTEM32\dwrite.dll
ModLoad: 6ea70000 6eba4000 C:\Windows\System32\Windows.Globalization.dll
ModLoad: 72a00000 72a35000 C:\Windows\System32\netprofm.dll
ModLoad: 710b0000 710b9000 C:\Windows\System32\npmproxy.dll
ModLoad: 746c0000 74744000 C:\Windows\SYSTEM32\DNSAPI.dll
ModLoad: 75c50000 75ca8000 C:\Windows\system32\coml2.dll
ModLoad: 739f0000 73a11000 C:\Windows\SYSTEM32\SLC.dll
ModLoad: 739a0000 739bd000 C:\Windows\SYSTEM32\sppc.dll
ModLoad: 6a1e0000 6a229000 C:\Windows\System32\Windows.Graphics.dll
ModLoad: 6d060000 6d093000 C:\Windows\System32\execmodelclient.dll
ModLoad: 71570000 715c4000 C:\Windows\SYSTEM32\MMDevAPI.DLL
ModLoad: 73ca0000 73cc1000 C:\Windows\SYSTEM32\DEVOBJ.dll
ModLoad: 70ab0000 70ab8000 C:\Windows\System32\rasadhlp.dll
ModLoad: 70f80000 70fc6000 C:\Windows\System32\fwpuclnt.dll
ModLoad: 73fb0000 73fce000 C:\Windows\System32\rmclient.dll
ModLoad: 70e10000 70e2d000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 6b460000 6b6e1000 C:\Windows\SYSTEM32\msftedit.dll
ModLoad: 73aa0000 73ac4000 C:\Windows\SYSTEM32\globinputhost.dll
ModLoad: 72ce0000 72cf2000 C:\Windows\System32\Windows.Globalization.Fontgroups.dll
ModLoad: 738c0000 738c9000 C:\Windows\SYSTEM32\fontgroupsoverride.dll
ModLoad: 6fc80000 6fc9d000 C:\Windows\System32\Windows.System.Profile.RetailInfo.dll
ModLoad: 6cf60000 6cff9000 C:\Windows\system32\twinapi.dll
ModLoad: 6ee90000 6ef00000 C:\Windows\system32\directmanipulation.dll
ModLoad: 6e060000 6e0ac000 C:\Windows\System32\ieproxy.dll
(b88.d24): Break instruction exception - code 80000003 (first chance)
eax=7f523000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=2081fb10 ebp=2081fb3c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc int 3
0:040> |.
. 0 id: b88 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
0:040> .childdbg 1
Processes created by the current process will be debugged
0:040> !gflag
Current NtGlobalFlag contents: 0x02000000
hpa - Place heap allocations at ends of pages
0:040> .attach 0n3512
Attach will occur on next execution
0:040> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00250000 0029b000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
ModLoad: 77dd0000 77f49000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000 C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 73ad0000 73b61000 C:\Windows\system32\apphelp.dll
ModLoad: 75aa0000 75b1b000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 77a80000 77b3e000 C:\Windows\system32\msvcrt.dll
ModLoad: 77520000 77563000 C:\Windows\system32\sechost.dll
ModLoad: 77b50000 77c12000 C:\Windows\system32\RPCRT4.dll
ModLoad: 77490000 7751d000 C:\Windows\system32\shcore.dll
ModLoad: 758b0000 75a6a000 C:\Windows\system32\combase.dll
ModLoad: 6ebb0000 6ee71000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 77940000 77a74000 C:\Windows\system32\user32.dll
ModLoad: 77610000 77765000 C:\Windows\system32\GDI32.dll
ModLoad: 75a70000 75a9f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 67cd0000 680e0000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EMODEL.dll
ModLoad: 77290000 772d4000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 75ed0000 7728e000 C:\Windows\system32\SHELL32.dll
ModLoad: 74fa0000 7547c000 C:\Windows\system32\windows.storage.dll
ModLoad: 74f30000 74f3c000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74f50000 74f94000 C:\Windows\system32\powrprof.dll
ModLoad: 74f40000 74f4f000 C:\Windows\system32\profapi.dll
ModLoad: 75dd0000 75eba000 C:\Windows\system32\ole32.dll
ModLoad: 75b40000 75bd2000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 75600000 75636000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 73f20000 73f7d000 C:\Windows\SYSTEM32\firewallapi.dll
ModLoad: 73ef0000 73f1d000 C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 73890000 738a3000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 74da0000 74df9000 C:\Windows\SYSTEM32\bcryptPrimitives.dll
ModLoad: 73c20000 73c99000 C:\Windows\system32\uxtheme.dll
ModLoad: 748f0000 74903000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000 C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 745d0000 745ff000 C:\Windows\system32\rsaenh.dll
ModLoad: 74a00000 74a0a000 C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 73cf0000 73dac000 C:\Windows\SYSTEM32\twinapi.appcore.dll
ModLoad: 746a0000 746b9000 C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 62170000 63370000 C:\Windows\SYSTEM32\EDGEHTML.dll
ModLoad: 65670000 65cad000 C:\Windows\SYSTEM32\chakra.dll
ModLoad: 73210000 73243000 C:\Windows\SYSTEM32\MLANG.dll
ModLoad: 71c90000 71d55000 C:\Windows\System32\WinTypes.dll
ModLoad: 6ccf0000 6cf14000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 74bb0000 74bd4000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 75bf0000 75c4c000 C:\Windows\system32\WS2_32.dll
ModLoad: 75be0000 75be7000 C:\Windows\system32\NSI.dll
ModLoad: 70ca0000 70cb1000 C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 72990000 729c0000 C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 72970000 72978000 C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 71f20000 71fc7000 C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 6df50000 6df61000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 744a0000 744c8000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 748a0000 748f0000 C:\Windows\system32\mswsock.dll
ModLoad: 6dcd0000 6de30000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 730e0000 730fd000 C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 678b0000 67a22000 C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 70990000 709bf000 C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 70920000 70985000 C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 71aa0000 71acd000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 746c0000 74744000 C:\Windows\SYSTEM32\DNSAPI.dll
ModLoad: 6d2c0000 6d2ff000 C:\Windows\system32\dataexchange.dll
ModLoad: 6b6f0000 6bb78000 C:\Windows\SYSTEM32\d2d1.dll
ModLoad: 70290000 704a3000 C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 73150000 731f8000 C:\Windows\SYSTEM32\dcomp.dll
ModLoad: 70210000 7028e000 C:\Windows\SYSTEM32\dxgi.dll
ModLoad: 6cf60000 6cff9000 C:\Windows\system32\twinapi.dll
ModLoad: 73100000 7314d000 C:\Windows\SYSTEM32\ninput.dll
ModLoad: 6bea0000 6c090000 C:\Windows\SYSTEM32\DWrite.dll
ModLoad: 6e6f0000 6e908000 C:\Windows\SYSTEM32\d3d10warp.dll
ModLoad: 72e90000 72f05000 C:\Windows\System32\Windows.UI.dll
ModLoad: 73200000 7320e000 C:\Windows\system32\msimtf.dll
ModLoad: 6ee90000 6ef00000 C:\Windows\system32\directmanipulation.dll
ModLoad: 6fb80000 6fc4b000 C:\Windows\System32\MrmCoreR.dll
ModLoad: 73810000 73861000 C:\Windows\SYSTEM32\Bcp47Langs.dll
ModLoad: 6ea70000 6eba4000 C:\Windows\SYSTEM32\windows.globalization.dll
ModLoad: 6e060000 6e0ac000 C:\Windows\System32\ieproxy.dll
ModLoad: 70f80000 70fc6000 C:\Windows\System32\fwpuclnt.dll
ModLoad: 70ab0000 70ab8000 C:\Windows\System32\rasadhlp.dll
(db8.5a8): Break instruction exception - code 80000003 (first chance)
eax=7f224000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=0e30fed0 ebp=0e30fefc iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc int 3
1:064> |.
. 1 id: db8 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
1:064> .childdbg 1
Processes created by the current process will be debugged
1:064> !gflag
Current NtGlobalFlag contents: 0x02000000
hpa - Place heap allocations at ends of pages
1:064> .attach 0n3124
Attach will occur on next execution
1:064> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00260000 00272000 C:\Windows\System32\RuntimeBroker.exe
ModLoad: 77dd0000 77f49000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000 C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 77a80000 77b3e000 C:\Windows\system32\msvcrt.dll
ModLoad: 77b50000 77c12000 C:\Windows\system32\RPCRT4.dll
ModLoad: 758b0000 75a6a000 C:\Windows\system32\combase.dll
ModLoad: 74f50000 74f94000 C:\Windows\system32\powrprof.dll
ModLoad: 74f30000 74f3c000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74da0000 74df9000 C:\Windows\System32\bcryptPrimitives.dll
ModLoad: 75dd0000 75eba000 C:\Windows\system32\ole32.dll
ModLoad: 77520000 77563000 C:\Windows\system32\sechost.dll
ModLoad: 77610000 77765000 C:\Windows\system32\GDI32.dll
ModLoad: 77940000 77a74000 C:\Windows\system32\USER32.dll
ModLoad: 75a70000 75a9f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 77c80000 77d02000 C:\Windows\system32\clbcatq.dll
ModLoad: 748f0000 74903000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000 C:\Windows\System32\bcrypt.dll
ModLoad: 745d0000 745ff000 C:\Windows\system32\rsaenh.dll
ModLoad: 74a00000 74a0a000 C:\Windows\System32\CRYPTBASE.dll
ModLoad: 70e10000 70e2d000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 74f40000 74f4f000 C:\Windows\system32\profapi.dll
ModLoad: 73cf0000 73dac000 C:\Windows\SYSTEM32\twinapi.appcore.dll
ModLoad: 746a0000 746b9000 C:\Windows\System32\USERENV.dll
ModLoad: 6df50000 6df61000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 744a0000 744c8000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 74bb0000 74bd4000 C:\Windows\system32\SspiCli.dll
ModLoad: 69920000 69931000 C:\Windows\SYSTEM32\capauthz.dll
ModLoad: 73ad0000 73b61000 C:\Windows\system32\apphelp.dll
(c34.3cc): Break instruction exception - code 80000003 (first chance)
eax=7f627000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=06a9f7b0 ebp=06a9f7dc iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc int 3
2:072> |.
. 2 id: c34 attach name: C:\Windows\System32\RuntimeBroker.exe
2:072> .childdbg 1
Processes created by the current process will be debugged
2:072> !gflag
Current NtGlobalFlag contents: 0x02000000
hpa - Place heap allocations at ends of pages
2:072> .attach 0n3940
Attach will occur on next execution
2:072> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 013d0000 013d8000 C:\Windows\system32\browser_broker.exe
ModLoad: 77dd0000 77f49000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000 C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 77a80000 77b3e000 C:\Windows\system32\msvcrt.dll
ModLoad: 758b0000 75a6a000 C:\Windows\system32\combase.dll
ModLoad: 77b50000 77c12000 C:\Windows\system32\RPCRT4.dll
ModLoad: 77520000 77563000 C:\Windows\system32\sechost.dll
ModLoad: 77940000 77a74000 C:\Windows\system32\user32.dll
ModLoad: 77610000 77765000 C:\Windows\system32\GDI32.dll
ModLoad: 75a70000 75a9f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 74f30000 74f3c000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74da0000 74df9000 C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 73c20000 73c99000 C:\Windows\system32\uxtheme.dll
ModLoad: 70fd0000 70fe4000 C:\Windows\SYSTEM32\browserbroker.dll
ModLoad: 77490000 7751d000 C:\Windows\system32\shcore.dll
ModLoad: 75b40000 75bd2000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 75480000 755f5000 C:\Windows\system32\CRYPT32.dll
ModLoad: 74f20000 74f2e000 C:\Windows\system32\MSASN1.dll
ModLoad: 6ebb0000 6ee71000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 75aa0000 75b1b000 C:\Windows\system32\advapi32.dll
ModLoad: 6dcd0000 6de30000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 77290000 772d4000 C:\Windows\system32\shlwapi.dll
ModLoad: 743c0000 743d7000 C:\Windows\SYSTEM32\MPR.dll
ModLoad: 6ccf0000 6cf14000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 71aa0000 71acd000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 74a00000 74a0a000 C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 74600000 74608000 C:\Windows\SYSTEM32\DPAPI.DLL
ModLoad: 77c80000 77d02000 C:\Windows\system32\clbcatq.dll
ModLoad: 748f0000 74903000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000 C:\Windows\system32\bcrypt.dll
ModLoad: 745d0000 745ff000 C:\Windows\system32\rsaenh.dll
ModLoad: 6e060000 6e0ac000 C:\Windows\System32\ieproxy.dll
ModLoad: 75dd0000 75eba000 C:\Windows\system32\ole32.dll
ModLoad: 74bb0000 74bd4000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 75ed0000 7728e000 C:\Windows\system32\SHELL32.dll
ModLoad: 74fa0000 7547c000 C:\Windows\system32\windows.storage.dll
ModLoad: 74f50000 74f94000 C:\Windows\system32\powrprof.dll
ModLoad: 74f40000 74f4f000 C:\Windows\system32\profapi.dll
(f64.754): Break instruction exception - code 80000003 (first chance)
eax=7fcc5000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=06b9fc38 ebp=06b9fc64 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc int 3
3:081> |.
. 3 id: f64 attach name: C:\Windows\system32\browser_broker.exe
3:081> .childdbg 1
Processes created by the current process will be debugged
3:081> !gflag
Current NtGlobalFlag contents: 0x02000000
hpa - Place heap allocations at ends of pages
3:081> |~[0n2952]s;~*m
eax=0b330000 ebx=00000000 ecx=00bdf784 edx=77e546f0 esi=00000002 edi=00000002
eip=77e546f0 esp=00bdf784 ebp=00bdf918 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
77e546f0 c3 ret
0:000> |~[0n3512]s;~*m
eax=0980e000 ebx=00000001 ecx=03dbf1a8 edx=77e546f0 esi=00000001 edi=00000001
eip=77e546f0 esp=03dbf1a8 ebp=03dbf33c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
77e546f0 c3 ret
1:041> |~[0n3124]s;~*m
eax=06252000 ebx=00000000 ecx=001ef95c edx=77e546f0 esi=00000002 edi=00000002
eip=77e546f0 esp=001ef95c ebp=001efaf0 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
77e546f0 c3 ret
2:040> |~[0n3940]s;~*m
eax=7fcc5000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=06b9fc38 ebp=06b9fc64 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc int 3
3:081> sxd *
3:081> sxd asrt
3:081> sxd aph
3:081> sxd av
3:081> sxd bpe
3:081> sxd dm
3:081> sxd dz
3:081> sxd eh
3:081> sxd gp
3:081> sxd ii
3:081> sxd iov
3:081> sxd ip
3:081> sxd isc
3:081> sxd lsq
3:081> sxd sbo
3:081> sxd sov
3:081> sxd sse
3:081> sxd ssec
3:081> sxd vcpp
3:081> sxd wkd
3:081> sxd wob
3:081> sxd wos
3:081> sxi ch
3:081> sxi hc
3:081> sxi ibp
3:081> sxi ld
3:081> sxi ud
3:081> sxi wos
3:081> sxe cpr
3:081> sxe epr
3:081> g
(db8.fec): Access violation - code c0000005 (first chance)
(db8.fec): Access violation - code c0000005 (!!! second chance !!!)
eax=00000003 ebx=0f050ff8 ecx=082fbb60 edx=0a5d2870 esi=082fbb60 edi=0f050ff8
eip=62aabc70 esp=096ac100 ebp=096ac10c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202
EDGEHTML!CMarkup::EnsureDeleteCFState+0xd:
62aabc70 837f0400 cmp dword ptr [edi+4],0 ds:0023:0f050ffc=????????
1:052> .lastevent
Last event: db8.fec: Access violation - code c0000005 (!!! second chance !!!)
debugger time: Wed Aug 26 10:13:33.362 2015 (UTC - 7:00)
1:052> |.
. 1 id: db8 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
1:052> .effmach
Effective machine: x86 compatible (x86)
1:052> lm on
start end module name
00250000 0029b000 microsoftedgecp microsoftedgecp.exe
62170000 63370000 EDGEHTML EDGEHTML.dll
65670000 65cad000 chakra chakra.dll
678b0000 67a22000 ieapfltr ieapfltr.dll
67cd0000 680e0000 EMODEL EMODEL.dll
6b6f0000 6bb78000 d2d1 d2d1.dll
6bea0000 6c090000 DWrite DWrite.dll
6ccf0000 6cf14000 WININET WININET.dll
6cf60000 6cff9000 twinapi twinapi.dll
6d2c0000 6d2ff000 dataexchange dataexchange.dll
6d510000 6d717000 ActXPrxy ActXPrxy.dll
6dcd0000 6de30000 urlmon urlmon.dll
6df50000 6df61000 profext profext.dll
6e060000 6e0ac000 ieproxy ieproxy.dll
6e0b0000 6e111000 verifier verifier.dll
6e6f0000 6e908000 d3d10warp d3d10warp.dll
6ea70000 6eba4000 windows_globalization windows.globalization.dll
6ebb0000 6ee71000 iertutil iertutil.dll
6ee90000 6ef00000 directmanipulation directmanipulation.dll
6fb80000 6fc4b000 MrmCoreR MrmCoreR.dll
70210000 7028e000 dxgi dxgi.dll
70290000 704a3000 d3d11 d3d11.dll
70920000 70985000 msvcp110_win msvcp110_win.dll
70990000 709bf000 policymanager policymanager.dll
70ab0000 70ab8000 rasadhlp rasadhlp.dll
70ca0000 70cb1000 ondemandconnroutehelper ondemandconnroutehelper.dll
70f80000 70fc6000 fwpuclnt fwpuclnt.dll
71aa0000 71acd000 XmlLite XmlLite.dll
71c90000 71d55000 WinTypes WinTypes.dll
71f20000 71fc7000 winhttp winhttp.dll
72970000 72978000 WINNSI WINNSI.DLL
72990000 729c0000 IPHLPAPI IPHLPAPI.DLL
72e90000 72f05000 Windows_UI Windows.UI.dll
730e0000 730fd000 dwmapi dwmapi.dll
73100000 7314d000 ninput ninput.dll
73150000 731f8000 dcomp dcomp.dll
73200000 7320e000 msimtf msimtf.dll
73210000 73243000 MLANG MLANG.dll
736b0000 737f2000 PROPSYS PROPSYS.dll
73810000 73861000 Bcp47Langs Bcp47Langs.dll
73890000 738a3000 EShims EShims.dll
73ad0000 73b61000 apphelp apphelp.dll
73c20000 73c99000 uxtheme uxtheme.dll
73cf0000 73dac000 twinapi_appcore twinapi.appcore.dll
73ef0000 73f1d000 fwbase fwbase.dll
73f20000 73f7d000 firewallapi firewallapi.dll
73fb0000 73fce000 rmclient rmclient.dll
744a0000 744c8000 ntmarta ntmarta.dll
745d0000 745ff000 rsaenh rsaenh.dll
746a0000 746b9000 USERENV USERENV.dll
746c0000 74744000 DNSAPI DNSAPI.dll
748a0000 748f0000 mswsock mswsock.dll
748f0000 74903000 cryptsp cryptsp.dll
74a00000 74a0a000 CRYPTBASE CRYPTBASE.dll
74bb0000 74bd4000 SspiCli SspiCli.dll
74da0000 74df9000 bcryptPrimitives bcryptPrimitives.dll
74e80000 74e9d000 bcrypt bcrypt.dll
74f30000 74f3c000 kernel_appcore kernel.appcore.dll
74f40000 74f4f000 profapi profapi.dll
74f50000 74f94000 powrprof powrprof.dll
74fa0000 7547c000 windows_storage windows.storage.dll
75600000 75636000 cfgmgr32 cfgmgr32.dll
75730000 758a7000 KERNELBASE KERNELBASE.dll
758b0000 75a6a000 combase combase.dll
75a70000 75a9f000 IMM32 IMM32.DLL
75aa0000 75b1b000 ADVAPI32 ADVAPI32.dll
75b40000 75bd2000 OLEAUT32 OLEAUT32.dll
75be0000 75be7000 NSI NSI.dll
75bf0000 75c4c000 WS2_32 WS2_32.dll
75cb0000 75dd0000 MSCTF MSCTF.dll
75dd0000 75eba000 ole32 ole32.dll
75ed0000 7728e000 SHELL32 SHELL32.dll
77290000 772d4000 SHLWAPI SHLWAPI.dll
77490000 7751d000 shcore shcore.dll
77520000 77563000 sechost sechost.dll
77570000 77605000 KERNEL32 KERNEL32.DLL
77610000 77765000 GDI32 GDI32.dll
77940000 77a74000 user32 user32.dll
77a80000 77b3e000 msvcrt msvcrt.dll
77b50000 77c12000 RPCRT4 RPCRT4.dll
77dd0000 77f49000 ntdll ntdll.dll
1:052> .exr -1
ExceptionAddress: 62aabc70 (EDGEHTML!CMarkup::EnsureDeleteCFState+0x0000000d)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000001
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0f050ffc
Attempt to read from address 0f050ffc
1:052> lmv M *microsoftedgecp.exe
start end module name
00250000 0029b000 microsoftedgecp (deferred)
Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Image name: microsoftedgecp.exe
Timestamp: Thu Jul 09 20:23:10 2015 (559F3A9E)
CheckSum: 00056441
ImageSize: 0004B000
File version: 11.0.10240.16384
Product version: 11.0.10240.16384
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Edge
InternalName: MicrosoftEdgeCP
OriginalFilename: MicrosoftEdgeCP.exe
ProductVersion: 11.00.10240.16384
FileVersion: 11.00.10240.16384 (th1.150709-1700)
FileDescription: Microsoft Edge Content Process
LegalCopyright: � Microsoft Corporation. All rights reserved.
1:052> !heap -p -a 0xF050FFC
address 0f050ffc found in
_DPH_HEAP_ROOT @ 4e01000
in free-ed allocation ( DPH_HEAP_BLOCK: VirtAddr VirtSize)
ef42d9c: f050000 2000
6e0b9cd2 verifier!AVrfDebugPageHeapFree+0x000000c2
77eb2e20 ntdll!RtlDebugFreeHeap+0x0000003c
77e6e0da ntdll!RtlpFreeHeap+0x0006c97a
77e65d2c ntdll!RtlpFreeHeapInternal+0x0000027e
77e00a3c ntdll!RtlFreeHeap+0x0000002c
62658b1d EDGEHTML!MemoryProtection::HeapFree+0x0000004d
62f060c3 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x000001cc
62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
6258a5b0 EDGEHTML!CTreeNode::CacheStyleForLayout+0x00000030
62f06077 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000180
62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
62950cd3 EDGEHTML!Layout::ContentReader::GetNearestBlockLevelAncestor+0x0032c793
625e2ded EDGEHTML!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree+0x000000bf
624d119b EDGEHTML!Tree::ElementNode::CreateWrapperElement+0x00000020
62f061e0 EDGEHTML!Tree::FirstLetterBuilder::CreateFirstLetterContainer+0x000000c1
62efd418 EDGEHTML!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers+0x00000058
6294f6e7 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f0c7
626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
62efd59f EDGEHTML!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer+0x00000117
6294f6b6 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f096
626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
62627c79 EDGEHTML!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask+0x00000059
626273e7 EDGEHTML!Layout::FlowBoxBuilder::MoveToNextPosition+0x00000117
62626d1d EDGEHTML!Layout::LayoutBuilderDriver::BuildPageLayout+0x000004cd
624f0201 EDGEHTML!Layout::PageCollection::FormatPage+0x0000010e
62520c1d EDGEHTML!Layout::PageCollection::LayoutPagesCore+0x0000026d
1:052> kn 0x14
# ChildEBP RetAddr
00 096ac10c 62f060c3 EDGEHTML!CMarkup::EnsureDeleteCFState+0xd
01 096ac158 62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x1cc
02 096ac1b8 6293f7b6 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x96
03 096ac240 6266f1a7 EDGEHTML!CGeneratedElement::ComputeFormats+0x354df6
04 096ac2e4 6266de78 EDGEHTML!CTreeNode::ComputeFormats+0x287
05 096acde8 62950cd3 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x48
06 096ace18 625e2ded EDGEHTML!Layout::ContentReader::GetNearestBlockLevelAncestor+0x32c793
07 096ace58 624d119b EDGEHTML!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree+0xbf
08 096ace84 62f061e0 EDGEHTML!Tree::ElementNode::CreateWrapperElement+0x20
09 096acea8 62efd418 EDGEHTML!Tree::FirstLetterBuilder::CreateFirstLetterContainer+0xc1
0a 096aced8 6294f6e7 EDGEHTML!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers+0x58
0b 096acef8 626244b3 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x32f0c7
0c 096acf10 62efd59f EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0xc3
0d 096acf30 6294f6b6 EDGEHTML!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer+0x117
0e 096acf58 626244b3 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x32f096
0f 096acf70 62627c79 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0xc3
10 096acf90 626273e7 EDGEHTML!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask+0x59
11 096acff4 62626d1d EDGEHTML!Layout::FlowBoxBuilder::MoveToNextPosition+0x117
12 096ad04c 624f0201 EDGEHTML!Layout::LayoutBuilderDriver::BuildPageLayout+0x4cd
13 096ad0fc 62520c1d EDGEHTML!Layout::PageCollection::FormatPage+0x10e
1:052>