Details
Id: AVR:Free microsoftedgecp.exe!EDGEHTML.dll!CMarkup::EnsureDeleteCFState 7C0A0A
Description: Access violation while reading memory at 0xF050FFC using a pointer to freed memory
Process binary: microsoftedgecp.exe
Location: EDGEHTML.dll!CMarkup::EnsureDeleteCFState + 0xD
Security impact: Potentially exploitable security issue
Stack
EDGEHTML.dll!CMarkup::EnsureDeleteCFState + 0xD (7C in id)
EDGEHTML.dll!Tree::FirstLetterBuilder::ComputeFirstLetterFormats + 0x1CC (7C0A in id)
EDGEHTML.dll!Tree::FirstLetterBuilder::ComputeFirstLetterFormats + 0x96 (7C0A0A in id)
EDGEHTML.dll!CGeneratedElement::ComputeFormats + 0x354DF6 (this symbol may not be correct)
EDGEHTML.dll!CTreeNode::ComputeFormats + 0x287
EDGEHTML.dll!CTreeNode::ComputeFormatsHelper + 0x48
EDGEHTML.dll!Layout::ContentReader::GetNearestBlockLevelAncestor + 0x32C793 (this symbol may not be correct)
EDGEHTML.dll!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree + 0xBF
EDGEHTML.dll!Tree::ElementNode::CreateWrapperElement + 0x20
EDGEHTML.dll!Tree::FirstLetterBuilder::CreateFirstLetterContainer + 0xC1
EDGEHTML.dll!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers + 0x58
EDGEHTML.dll!Tree::FirstLetterBuilder::EnsureFirstLetterElement + 0x32F0C7 (this symbol may not be correct)
EDGEHTML.dll!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock + 0xC3
EDGEHTML.dll!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer + 0x117
EDGEHTML.dll!Tree::FirstLetterBuilder::EnsureFirstLetterElement + 0x32F096 (this symbol may not be correct)
EDGEHTML.dll!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock + 0xC3
EDGEHTML.dll!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask + 0x59
EDGEHTML.dll!Layout::FlowBoxBuilder::MoveToNextPosition + 0x117
EDGEHTML.dll!Layout::LayoutBuilderDriver::BuildPageLayout + 0x4CD
... (rest of the stack was ignored)
microsoftedgecp.exe version information
    Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
    Image name: microsoftedgecp.exe
    Timestamp:        Thu Jul 09 20:23:10 2015 (559F3A9E)
    CheckSum:         00056441
    ImageSize:        0004B000
    File version:     11.0.10240.16384
    Product version:  11.0.10240.16384
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Edge
    InternalName:     MicrosoftEdgeCP
    OriginalFilename: MicrosoftEdgeCP.exe
    ProductVersion:   11.00.10240.16384
    FileVersion:      11.00.10240.16384 (th1.150709-1700)
    FileDescription:  Microsoft Edge Content Process
    LegalCopyright:   � Microsoft Corporation. All rights reserved.
Page heap report for address 0xF050FFC:
    address 0f050ffc found in
    _DPH_HEAP_ROOT @ 4e01000
    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                    ef42d9c:          f050000             2000
    6e0b9cd2 verifier!AVrfDebugPageHeapFree+0x000000c2
    77eb2e20 ntdll!RtlDebugFreeHeap+0x0000003c
    77e6e0da ntdll!RtlpFreeHeap+0x0006c97a
    77e65d2c ntdll!RtlpFreeHeapInternal+0x0000027e
    77e00a3c ntdll!RtlFreeHeap+0x0000002c
    62658b1d EDGEHTML!MemoryProtection::HeapFree+0x0000004d
    62f060c3 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x000001cc
    62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
    6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
    6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
    6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
    6258a5b0 EDGEHTML!CTreeNode::CacheStyleForLayout+0x00000030
    62f06077 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000180
    62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
    6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
    6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
    6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
    62950cd3 EDGEHTML!Layout::ContentReader::GetNearestBlockLevelAncestor+0x0032c793
    625e2ded EDGEHTML!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree+0x000000bf
    624d119b EDGEHTML!Tree::ElementNode::CreateWrapperElement+0x00000020
    62f061e0 EDGEHTML!Tree::FirstLetterBuilder::CreateFirstLetterContainer+0x000000c1
    62efd418 EDGEHTML!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers+0x00000058
    6294f6e7 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f0c7
    626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
    62efd59f EDGEHTML!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer+0x00000117
    6294f6b6 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f096
    626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
    62627c79 EDGEHTML!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask+0x00000059
    626273e7 EDGEHTML!Layout::FlowBoxBuilder::MoveToNextPosition+0x00000117
    62626d1d EDGEHTML!Layout::LayoutBuilderDriver::BuildPageLayout+0x000004cd
    624f0201 EDGEHTML!Layout::PageCollection::FormatPage+0x0000010e
    62520c1d EDGEHTML!Layout::PageCollection::LayoutPagesCore+0x0000026d
 
Debugger input/output

Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*http://msdl.microsoft.com/download/symbols
Deferred                                       cache*C:\Symbols*\\server\Symbols
Deferred                                       srv*http://symbols.mozilla.org/firefox
Deferred                                       srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is: 
ModLoad: 00c30000 01054000   C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
ModLoad: 77dd0000 77f49000   C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000   C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000   C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 73ad0000 73b61000   C:\Windows\system32\apphelp.dll
ModLoad: 75aa0000 75b1b000   C:\Windows\system32\ADVAPI32.dll
ModLoad: 77a80000 77b3e000   C:\Windows\system32\msvcrt.dll
ModLoad: 77520000 77563000   C:\Windows\system32\sechost.dll
ModLoad: 77b50000 77c12000   C:\Windows\system32\RPCRT4.dll
ModLoad: 75dd0000 75eba000   C:\Windows\system32\ole32.dll
ModLoad: 758b0000 75a6a000   C:\Windows\system32\combase.dll
ModLoad: 77610000 77765000   C:\Windows\system32\GDI32.dll
ModLoad: 77940000 77a74000   C:\Windows\system32\USER32.dll
ModLoad: 738f0000 73939000   C:\Windows\SYSTEM32\wincorlib.DLL
ModLoad: 75b40000 75bd2000   C:\Windows\system32\OLEAUT32.dll
ModLoad: 75a70000 75a9f000   C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000   C:\Windows\system32\MSCTF.dll
ModLoad: 74f30000 74f3c000   C:\Windows\system32\kernel.appcore.dll
ModLoad: 74da0000 74df9000   C:\Windows\SYSTEM32\bcryptPrimitives.dll
ModLoad: 748f0000 74903000   C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000   C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 6ef00000 6fb72000   C:\Windows\System32\Windows.UI.Xaml.dll
ModLoad: 71c90000 71d55000   C:\Windows\SYSTEM32\wintypes.dll
ModLoad: 733d0000 73461000   C:\Windows\SYSTEM32\CoreMessaging.dll
ModLoad: 73100000 7314d000   C:\Windows\SYSTEM32\NInput.dll
ModLoad: 6ebb0000 6ee71000   C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 77490000 7751d000   C:\Windows\system32\shcore.dll
ModLoad: 73810000 73861000   C:\Windows\SYSTEM32\Bcp47Langs.dll
ModLoad: 745d0000 745ff000   C:\Windows\system32\rsaenh.dll
ModLoad: 74a00000 74a0a000   C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 73cf0000 73dac000   C:\Windows\System32\twinapi.appcore.dll
ModLoad: 746a0000 746b9000   C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 74f40000 74f4f000   C:\Windows\system32\profapi.dll
ModLoad: 73890000 738a3000   C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 67cd0000 680e0000   C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eModel.dll
ModLoad: 77290000 772d4000   C:\Windows\system32\SHLWAPI.dll
ModLoad: 75ed0000 7728e000   C:\Windows\system32\SHELL32.dll
ModLoad: 74fa0000 7547c000   C:\Windows\system32\windows.storage.dll
ModLoad: 74f50000 74f94000   C:\Windows\system32\powrprof.dll
ModLoad: 75600000 75636000   C:\Windows\system32\cfgmgr32.dll
ModLoad: 73f20000 73f7d000   C:\Windows\SYSTEM32\firewallapi.dll
ModLoad: 73ef0000 73f1d000   C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 6d510000 6d717000   C:\Windows\System32\ActXPrxy.dll
ModLoad: 73c20000 73c99000   C:\Windows\system32\uxtheme.dll
ModLoad: 730e0000 730fd000   C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 6cb40000 6ccf0000   C:\Windows\system32\CoreUIComponents.dll
ModLoad: 70210000 7028e000   C:\Windows\SYSTEM32\dxgi.dll
ModLoad: 70290000 704a3000   C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 69d80000 69da9000   C:\Windows\System32\Windows.ApplicationModel.dll
ModLoad: 6e6f0000 6e908000   C:\Windows\SYSTEM32\d3d10warp.dll
ModLoad: 6b6f0000 6bb78000   C:\Windows\SYSTEM32\d2d1.dll
ModLoad: 67a30000 67cc4000   C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eView.dll
ModLoad: 6dcd0000 6de30000   C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 73150000 731f8000   C:\Windows\System32\dcomp.dll
ModLoad: 6fb80000 6fc4b000   C:\Windows\System32\MrmCoreR.dll
ModLoad: 72e90000 72f05000   C:\Windows\System32\Windows.UI.dll
ModLoad: 6d2c0000 6d2ff000   C:\Windows\system32\DataExchange.dll
ModLoad: 6df50000 6df61000   C:\Windows\SYSTEM32\profext.dll
ModLoad: 744a0000 744c8000   C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 6ccf0000 6cf14000   C:\Windows\SYSTEM32\WININET.dll
ModLoad: 74bb0000 74bd4000   C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 736b0000 737f2000   C:\Windows\SYSTEM32\PROPSYS.dll
ModLoad: 70990000 709bf000   C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 70920000 70985000   C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 71aa0000 71acd000   C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 75bf0000 75c4c000   C:\Windows\system32\WS2_32.dll
ModLoad: 75be0000 75be7000   C:\Windows\system32\NSI.dll
ModLoad: 70ca0000 70cb1000   C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 72990000 729c0000   C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 72970000 72978000   C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 71f20000 71fc7000   C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 748a0000 748f0000   C:\Windows\system32\mswsock.dll
ModLoad: 72fe0000 72fef000   C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll
ModLoad: 6cf50000 6cf5c000   C:\Windows\system32\execmodelproxy.dll
ModLoad: 678b0000 67a22000   C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 6bea0000 6c090000   C:\Windows\SYSTEM32\dwrite.dll
ModLoad: 6ea70000 6eba4000   C:\Windows\System32\Windows.Globalization.dll
ModLoad: 72a00000 72a35000   C:\Windows\System32\netprofm.dll
ModLoad: 710b0000 710b9000   C:\Windows\System32\npmproxy.dll
ModLoad: 746c0000 74744000   C:\Windows\SYSTEM32\DNSAPI.dll
ModLoad: 75c50000 75ca8000   C:\Windows\system32\coml2.dll
ModLoad: 739f0000 73a11000   C:\Windows\SYSTEM32\SLC.dll
ModLoad: 739a0000 739bd000   C:\Windows\SYSTEM32\sppc.dll
ModLoad: 6a1e0000 6a229000   C:\Windows\System32\Windows.Graphics.dll
ModLoad: 6d060000 6d093000   C:\Windows\System32\execmodelclient.dll
ModLoad: 71570000 715c4000   C:\Windows\SYSTEM32\MMDevAPI.DLL
ModLoad: 73ca0000 73cc1000   C:\Windows\SYSTEM32\DEVOBJ.dll
ModLoad: 70ab0000 70ab8000   C:\Windows\System32\rasadhlp.dll
ModLoad: 70f80000 70fc6000   C:\Windows\System32\fwpuclnt.dll
ModLoad: 73fb0000 73fce000   C:\Windows\System32\rmclient.dll
ModLoad: 70e10000 70e2d000   C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 6b460000 6b6e1000   C:\Windows\SYSTEM32\msftedit.dll
ModLoad: 73aa0000 73ac4000   C:\Windows\SYSTEM32\globinputhost.dll
ModLoad: 72ce0000 72cf2000   C:\Windows\System32\Windows.Globalization.Fontgroups.dll
ModLoad: 738c0000 738c9000   C:\Windows\SYSTEM32\fontgroupsoverride.dll
ModLoad: 6fc80000 6fc9d000   C:\Windows\System32\Windows.System.Profile.RetailInfo.dll
ModLoad: 6cf60000 6cff9000   C:\Windows\system32\twinapi.dll
ModLoad: 6ee90000 6ef00000   C:\Windows\system32\directmanipulation.dll
ModLoad: 6e060000 6e0ac000   C:\Windows\System32\ieproxy.dll
(b88.d24): Break instruction exception - code 80000003 (first chance)
eax=7f523000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=2081fb10 ebp=2081fb3c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc              int     3
0:040> |.
.  0 id: b88 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
0:040> .childdbg 1
Processes created by the current process will be debugged
0:040> !gflag
Current NtGlobalFlag contents: 0x02000000
    hpa - Place heap allocations at ends of pages
0:040> .attach 0n3512
Attach will occur on next execution
0:040> g
*** wait with pending attach

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*http://msdl.microsoft.com/download/symbols
Deferred                                       cache*C:\Symbols*\\server\Symbols
Deferred                                       srv*http://symbols.mozilla.org/firefox
Deferred                                       srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is: 
ModLoad: 00250000 0029b000   C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
ModLoad: 77dd0000 77f49000   C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000   C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000   C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 73ad0000 73b61000   C:\Windows\system32\apphelp.dll
ModLoad: 75aa0000 75b1b000   C:\Windows\system32\ADVAPI32.dll
ModLoad: 77a80000 77b3e000   C:\Windows\system32\msvcrt.dll
ModLoad: 77520000 77563000   C:\Windows\system32\sechost.dll
ModLoad: 77b50000 77c12000   C:\Windows\system32\RPCRT4.dll
ModLoad: 77490000 7751d000   C:\Windows\system32\shcore.dll
ModLoad: 758b0000 75a6a000   C:\Windows\system32\combase.dll
ModLoad: 6ebb0000 6ee71000   C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 77940000 77a74000   C:\Windows\system32\user32.dll
ModLoad: 77610000 77765000   C:\Windows\system32\GDI32.dll
ModLoad: 75a70000 75a9f000   C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000   C:\Windows\system32\MSCTF.dll
ModLoad: 67cd0000 680e0000   C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EMODEL.dll
ModLoad: 77290000 772d4000   C:\Windows\system32\SHLWAPI.dll
ModLoad: 75ed0000 7728e000   C:\Windows\system32\SHELL32.dll
ModLoad: 74fa0000 7547c000   C:\Windows\system32\windows.storage.dll
ModLoad: 74f30000 74f3c000   C:\Windows\system32\kernel.appcore.dll
ModLoad: 74f50000 74f94000   C:\Windows\system32\powrprof.dll
ModLoad: 74f40000 74f4f000   C:\Windows\system32\profapi.dll
ModLoad: 75dd0000 75eba000   C:\Windows\system32\ole32.dll
ModLoad: 75b40000 75bd2000   C:\Windows\system32\OLEAUT32.dll
ModLoad: 75600000 75636000   C:\Windows\system32\cfgmgr32.dll
ModLoad: 73f20000 73f7d000   C:\Windows\SYSTEM32\firewallapi.dll
ModLoad: 73ef0000 73f1d000   C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 73890000 738a3000   C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 74da0000 74df9000   C:\Windows\SYSTEM32\bcryptPrimitives.dll
ModLoad: 73c20000 73c99000   C:\Windows\system32\uxtheme.dll
ModLoad: 748f0000 74903000   C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000   C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 745d0000 745ff000   C:\Windows\system32\rsaenh.dll
ModLoad: 74a00000 74a0a000   C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 73cf0000 73dac000   C:\Windows\SYSTEM32\twinapi.appcore.dll
ModLoad: 746a0000 746b9000   C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 62170000 63370000   C:\Windows\SYSTEM32\EDGEHTML.dll
ModLoad: 65670000 65cad000   C:\Windows\SYSTEM32\chakra.dll
ModLoad: 73210000 73243000   C:\Windows\SYSTEM32\MLANG.dll
ModLoad: 71c90000 71d55000   C:\Windows\System32\WinTypes.dll
ModLoad: 6ccf0000 6cf14000   C:\Windows\SYSTEM32\WININET.dll
ModLoad: 74bb0000 74bd4000   C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 75bf0000 75c4c000   C:\Windows\system32\WS2_32.dll
ModLoad: 75be0000 75be7000   C:\Windows\system32\NSI.dll
ModLoad: 70ca0000 70cb1000   C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 72990000 729c0000   C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 72970000 72978000   C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 71f20000 71fc7000   C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 6df50000 6df61000   C:\Windows\SYSTEM32\profext.dll
ModLoad: 744a0000 744c8000   C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 748a0000 748f0000   C:\Windows\system32\mswsock.dll
ModLoad: 6dcd0000 6de30000   C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 730e0000 730fd000   C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 678b0000 67a22000   C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 70990000 709bf000   C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 70920000 70985000   C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 71aa0000 71acd000   C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 746c0000 74744000   C:\Windows\SYSTEM32\DNSAPI.dll
ModLoad: 6d2c0000 6d2ff000   C:\Windows\system32\dataexchange.dll
ModLoad: 6b6f0000 6bb78000   C:\Windows\SYSTEM32\d2d1.dll
ModLoad: 70290000 704a3000   C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 73150000 731f8000   C:\Windows\SYSTEM32\dcomp.dll
ModLoad: 70210000 7028e000   C:\Windows\SYSTEM32\dxgi.dll
ModLoad: 6cf60000 6cff9000   C:\Windows\system32\twinapi.dll
ModLoad: 73100000 7314d000   C:\Windows\SYSTEM32\ninput.dll
ModLoad: 6bea0000 6c090000   C:\Windows\SYSTEM32\DWrite.dll
ModLoad: 6e6f0000 6e908000   C:\Windows\SYSTEM32\d3d10warp.dll
ModLoad: 72e90000 72f05000   C:\Windows\System32\Windows.UI.dll
ModLoad: 73200000 7320e000   C:\Windows\system32\msimtf.dll
ModLoad: 6ee90000 6ef00000   C:\Windows\system32\directmanipulation.dll
ModLoad: 6fb80000 6fc4b000   C:\Windows\System32\MrmCoreR.dll
ModLoad: 73810000 73861000   C:\Windows\SYSTEM32\Bcp47Langs.dll
ModLoad: 6ea70000 6eba4000   C:\Windows\SYSTEM32\windows.globalization.dll
ModLoad: 6e060000 6e0ac000   C:\Windows\System32\ieproxy.dll
ModLoad: 70f80000 70fc6000   C:\Windows\System32\fwpuclnt.dll
ModLoad: 70ab0000 70ab8000   C:\Windows\System32\rasadhlp.dll
(db8.5a8): Break instruction exception - code 80000003 (first chance)
eax=7f224000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=0e30fed0 ebp=0e30fefc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc              int     3
1:064> |.
.  1 id: db8 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
1:064> .childdbg 1
Processes created by the current process will be debugged
1:064> !gflag
Current NtGlobalFlag contents: 0x02000000
    hpa - Place heap allocations at ends of pages
1:064> .attach 0n3124
Attach will occur on next execution
1:064> g
*** wait with pending attach

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*http://msdl.microsoft.com/download/symbols
Deferred                                       cache*C:\Symbols*\\server\Symbols
Deferred                                       srv*http://symbols.mozilla.org/firefox
Deferred                                       srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is: 
ModLoad: 00260000 00272000   C:\Windows\System32\RuntimeBroker.exe
ModLoad: 77dd0000 77f49000   C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000   C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000   C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 77a80000 77b3e000   C:\Windows\system32\msvcrt.dll
ModLoad: 77b50000 77c12000   C:\Windows\system32\RPCRT4.dll
ModLoad: 758b0000 75a6a000   C:\Windows\system32\combase.dll
ModLoad: 74f50000 74f94000   C:\Windows\system32\powrprof.dll
ModLoad: 74f30000 74f3c000   C:\Windows\system32\kernel.appcore.dll
ModLoad: 74da0000 74df9000   C:\Windows\System32\bcryptPrimitives.dll
ModLoad: 75dd0000 75eba000   C:\Windows\system32\ole32.dll
ModLoad: 77520000 77563000   C:\Windows\system32\sechost.dll
ModLoad: 77610000 77765000   C:\Windows\system32\GDI32.dll
ModLoad: 77940000 77a74000   C:\Windows\system32\USER32.dll
ModLoad: 75a70000 75a9f000   C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000   C:\Windows\system32\MSCTF.dll
ModLoad: 77c80000 77d02000   C:\Windows\system32\clbcatq.dll
ModLoad: 748f0000 74903000   C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000   C:\Windows\System32\bcrypt.dll
ModLoad: 745d0000 745ff000   C:\Windows\system32\rsaenh.dll
ModLoad: 74a00000 74a0a000   C:\Windows\System32\CRYPTBASE.dll
ModLoad: 70e10000 70e2d000   C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 74f40000 74f4f000   C:\Windows\system32\profapi.dll
ModLoad: 73cf0000 73dac000   C:\Windows\SYSTEM32\twinapi.appcore.dll
ModLoad: 746a0000 746b9000   C:\Windows\System32\USERENV.dll
ModLoad: 6df50000 6df61000   C:\Windows\SYSTEM32\profext.dll
ModLoad: 744a0000 744c8000   C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 74bb0000 74bd4000   C:\Windows\system32\SspiCli.dll
ModLoad: 69920000 69931000   C:\Windows\SYSTEM32\capauthz.dll
ModLoad: 73ad0000 73b61000   C:\Windows\system32\apphelp.dll
(c34.3cc): Break instruction exception - code 80000003 (first chance)
eax=7f627000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=06a9f7b0 ebp=06a9f7dc iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc              int     3
2:072> |.
.  2 id: c34 attach name: C:\Windows\System32\RuntimeBroker.exe
2:072> .childdbg 1
Processes created by the current process will be debugged
2:072> !gflag
Current NtGlobalFlag contents: 0x02000000
    hpa - Place heap allocations at ends of pages
2:072> .attach 0n3940
Attach will occur on next execution
2:072> g
*** wait with pending attach

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*http://msdl.microsoft.com/download/symbols
Deferred                                       cache*C:\Symbols*\\server\Symbols
Deferred                                       srv*http://symbols.mozilla.org/firefox
Deferred                                       srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is: 
ModLoad: 013d0000 013d8000   C:\Windows\system32\browser_broker.exe
ModLoad: 77dd0000 77f49000   C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6e0b0000 6e111000   C:\Windows\system32\verifier.dll
ModLoad: 77570000 77605000   C:\Windows\system32\KERNEL32.DLL
ModLoad: 75730000 758a7000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 77a80000 77b3e000   C:\Windows\system32\msvcrt.dll
ModLoad: 758b0000 75a6a000   C:\Windows\system32\combase.dll
ModLoad: 77b50000 77c12000   C:\Windows\system32\RPCRT4.dll
ModLoad: 77520000 77563000   C:\Windows\system32\sechost.dll
ModLoad: 77940000 77a74000   C:\Windows\system32\user32.dll
ModLoad: 77610000 77765000   C:\Windows\system32\GDI32.dll
ModLoad: 75a70000 75a9f000   C:\Windows\system32\IMM32.DLL
ModLoad: 75cb0000 75dd0000   C:\Windows\system32\MSCTF.dll
ModLoad: 74f30000 74f3c000   C:\Windows\system32\kernel.appcore.dll
ModLoad: 74da0000 74df9000   C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 73c20000 73c99000   C:\Windows\system32\uxtheme.dll
ModLoad: 70fd0000 70fe4000   C:\Windows\SYSTEM32\browserbroker.dll
ModLoad: 77490000 7751d000   C:\Windows\system32\shcore.dll
ModLoad: 75b40000 75bd2000   C:\Windows\system32\OLEAUT32.dll
ModLoad: 75480000 755f5000   C:\Windows\system32\CRYPT32.dll
ModLoad: 74f20000 74f2e000   C:\Windows\system32\MSASN1.dll
ModLoad: 6ebb0000 6ee71000   C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 75aa0000 75b1b000   C:\Windows\system32\advapi32.dll
ModLoad: 6dcd0000 6de30000   C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 77290000 772d4000   C:\Windows\system32\shlwapi.dll
ModLoad: 743c0000 743d7000   C:\Windows\SYSTEM32\MPR.dll
ModLoad: 6ccf0000 6cf14000   C:\Windows\SYSTEM32\WININET.dll
ModLoad: 71aa0000 71acd000   C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 74a00000 74a0a000   C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 74600000 74608000   C:\Windows\SYSTEM32\DPAPI.DLL
ModLoad: 77c80000 77d02000   C:\Windows\system32\clbcatq.dll
ModLoad: 748f0000 74903000   C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74e80000 74e9d000   C:\Windows\system32\bcrypt.dll
ModLoad: 745d0000 745ff000   C:\Windows\system32\rsaenh.dll
ModLoad: 6e060000 6e0ac000   C:\Windows\System32\ieproxy.dll
ModLoad: 75dd0000 75eba000   C:\Windows\system32\ole32.dll
ModLoad: 74bb0000 74bd4000   C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 75ed0000 7728e000   C:\Windows\system32\SHELL32.dll
ModLoad: 74fa0000 7547c000   C:\Windows\system32\windows.storage.dll
ModLoad: 74f50000 74f94000   C:\Windows\system32\powrprof.dll
ModLoad: 74f40000 74f4f000   C:\Windows\system32\profapi.dll
(f64.754): Break instruction exception - code 80000003 (first chance)
eax=7fcc5000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=06b9fc38 ebp=06b9fc64 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc              int     3
3:081> |.
.  3 id: f64 attach name: C:\Windows\system32\browser_broker.exe
3:081> .childdbg 1
Processes created by the current process will be debugged
3:081> !gflag
Current NtGlobalFlag contents: 0x02000000
    hpa - Place heap allocations at ends of pages
3:081> |~[0n2952]s;~*m
eax=0b330000 ebx=00000000 ecx=00bdf784 edx=77e546f0 esi=00000002 edi=00000002
eip=77e546f0 esp=00bdf784 ebp=00bdf918 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
77e546f0 c3              ret
0:000> |~[0n3512]s;~*m
eax=0980e000 ebx=00000001 ecx=03dbf1a8 edx=77e546f0 esi=00000001 edi=00000001
eip=77e546f0 esp=03dbf1a8 ebp=03dbf33c iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
77e546f0 c3              ret
1:041> |~[0n3124]s;~*m
eax=06252000 ebx=00000000 ecx=001ef95c edx=77e546f0 esi=00000002 edi=00000002
eip=77e546f0 esp=001ef95c ebp=001efaf0 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
77e546f0 c3              ret
2:040> |~[0n3940]s;~*m
eax=7fcc5000 ebx=00000000 ecx=77e8afb0 edx=00401100 esi=77e8afb0 edi=77e8afb0
eip=77e54550 esp=06b9fc38 ebp=06b9fc64 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
77e54550 cc              int     3
3:081> sxd *
3:081> sxd asrt
3:081> sxd aph
3:081> sxd av
3:081> sxd bpe
3:081> sxd dm
3:081> sxd dz
3:081> sxd eh
3:081> sxd gp
3:081> sxd ii
3:081> sxd iov
3:081> sxd ip
3:081> sxd isc
3:081> sxd lsq
3:081> sxd sbo
3:081> sxd sov
3:081> sxd sse
3:081> sxd ssec
3:081> sxd vcpp
3:081> sxd wkd
3:081> sxd wob
3:081> sxd wos
3:081> sxi ch
3:081> sxi hc
3:081> sxi ibp
3:081> sxi ld
3:081> sxi ud
3:081> sxi wos
3:081> sxe cpr
3:081> sxe epr
3:081> g
(db8.fec): Access violation - code c0000005 (first chance)
(db8.fec): Access violation - code c0000005 (!!! second chance !!!)
eax=00000003 ebx=0f050ff8 ecx=082fbb60 edx=0a5d2870 esi=082fbb60 edi=0f050ff8
eip=62aabc70 esp=096ac100 ebp=096ac10c iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
EDGEHTML!CMarkup::EnsureDeleteCFState+0xd:
62aabc70 837f0400        cmp     dword ptr [edi+4],0  ds:0023:0f050ffc=????????
1:052> .lastevent
Last event: db8.fec: Access violation - code c0000005 (!!! second chance !!!)
  debugger time: Wed Aug 26 10:13:33.362 2015 (UTC - 7:00)
1:052> |.
.  1 id: db8 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
1:052> .effmach
Effective machine: x86 compatible (x86)
1:052> lm on
start    end        module name
00250000 0029b000   microsoftedgecp microsoftedgecp.exe
62170000 63370000   EDGEHTML EDGEHTML.dll
65670000 65cad000   chakra   chakra.dll  
678b0000 67a22000   ieapfltr ieapfltr.dll
67cd0000 680e0000   EMODEL   EMODEL.dll  
6b6f0000 6bb78000   d2d1     d2d1.dll    
6bea0000 6c090000   DWrite   DWrite.dll  
6ccf0000 6cf14000   WININET  WININET.dll 
6cf60000 6cff9000   twinapi  twinapi.dll 
6d2c0000 6d2ff000   dataexchange dataexchange.dll
6d510000 6d717000   ActXPrxy ActXPrxy.dll
6dcd0000 6de30000   urlmon   urlmon.dll  
6df50000 6df61000   profext  profext.dll 
6e060000 6e0ac000   ieproxy  ieproxy.dll 
6e0b0000 6e111000   verifier verifier.dll
6e6f0000 6e908000   d3d10warp d3d10warp.dll
6ea70000 6eba4000   windows_globalization windows.globalization.dll
6ebb0000 6ee71000   iertutil iertutil.dll
6ee90000 6ef00000   directmanipulation directmanipulation.dll
6fb80000 6fc4b000   MrmCoreR MrmCoreR.dll
70210000 7028e000   dxgi     dxgi.dll    
70290000 704a3000   d3d11    d3d11.dll   
70920000 70985000   msvcp110_win msvcp110_win.dll
70990000 709bf000   policymanager policymanager.dll
70ab0000 70ab8000   rasadhlp rasadhlp.dll
70ca0000 70cb1000   ondemandconnroutehelper ondemandconnroutehelper.dll
70f80000 70fc6000   fwpuclnt fwpuclnt.dll
71aa0000 71acd000   XmlLite  XmlLite.dll 
71c90000 71d55000   WinTypes WinTypes.dll
71f20000 71fc7000   winhttp  winhttp.dll 
72970000 72978000   WINNSI   WINNSI.DLL  
72990000 729c0000   IPHLPAPI IPHLPAPI.DLL
72e90000 72f05000   Windows_UI Windows.UI.dll
730e0000 730fd000   dwmapi   dwmapi.dll  
73100000 7314d000   ninput   ninput.dll  
73150000 731f8000   dcomp    dcomp.dll   
73200000 7320e000   msimtf   msimtf.dll  
73210000 73243000   MLANG    MLANG.dll   
736b0000 737f2000   PROPSYS  PROPSYS.dll 
73810000 73861000   Bcp47Langs Bcp47Langs.dll
73890000 738a3000   EShims   EShims.dll  
73ad0000 73b61000   apphelp  apphelp.dll 
73c20000 73c99000   uxtheme  uxtheme.dll 
73cf0000 73dac000   twinapi_appcore twinapi.appcore.dll
73ef0000 73f1d000   fwbase   fwbase.dll  
73f20000 73f7d000   firewallapi firewallapi.dll
73fb0000 73fce000   rmclient rmclient.dll
744a0000 744c8000   ntmarta  ntmarta.dll 
745d0000 745ff000   rsaenh   rsaenh.dll  
746a0000 746b9000   USERENV  USERENV.dll 
746c0000 74744000   DNSAPI   DNSAPI.dll  
748a0000 748f0000   mswsock  mswsock.dll 
748f0000 74903000   cryptsp  cryptsp.dll 
74a00000 74a0a000   CRYPTBASE CRYPTBASE.dll
74bb0000 74bd4000   SspiCli  SspiCli.dll 
74da0000 74df9000   bcryptPrimitives bcryptPrimitives.dll
74e80000 74e9d000   bcrypt   bcrypt.dll  
74f30000 74f3c000   kernel_appcore kernel.appcore.dll
74f40000 74f4f000   profapi  profapi.dll 
74f50000 74f94000   powrprof powrprof.dll
74fa0000 7547c000   windows_storage windows.storage.dll
75600000 75636000   cfgmgr32 cfgmgr32.dll
75730000 758a7000   KERNELBASE KERNELBASE.dll
758b0000 75a6a000   combase  combase.dll 
75a70000 75a9f000   IMM32    IMM32.DLL   
75aa0000 75b1b000   ADVAPI32 ADVAPI32.dll
75b40000 75bd2000   OLEAUT32 OLEAUT32.dll
75be0000 75be7000   NSI      NSI.dll     
75bf0000 75c4c000   WS2_32   WS2_32.dll  
75cb0000 75dd0000   MSCTF    MSCTF.dll   
75dd0000 75eba000   ole32    ole32.dll   
75ed0000 7728e000   SHELL32  SHELL32.dll 
77290000 772d4000   SHLWAPI  SHLWAPI.dll 
77490000 7751d000   shcore   shcore.dll  
77520000 77563000   sechost  sechost.dll 
77570000 77605000   KERNEL32 KERNEL32.DLL
77610000 77765000   GDI32    GDI32.dll   
77940000 77a74000   user32   user32.dll  
77a80000 77b3e000   msvcrt   msvcrt.dll  
77b50000 77c12000   RPCRT4   RPCRT4.dll  
77dd0000 77f49000   ntdll    ntdll.dll   
1:052> .exr -1
ExceptionAddress: 62aabc70 (EDGEHTML!CMarkup::EnsureDeleteCFState+0x0000000d)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000001
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0f050ffc
Attempt to read from address 0f050ffc
1:052> lmv M *microsoftedgecp.exe
start    end        module name
00250000 0029b000   microsoftedgecp   (deferred)             
    Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
    Image name: microsoftedgecp.exe
    Timestamp:        Thu Jul 09 20:23:10 2015 (559F3A9E)
    CheckSum:         00056441
    ImageSize:        0004B000
    File version:     11.0.10240.16384
    Product version:  11.0.10240.16384
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft Edge
    InternalName:     MicrosoftEdgeCP
    OriginalFilename: MicrosoftEdgeCP.exe
    ProductVersion:   11.00.10240.16384
    FileVersion:      11.00.10240.16384 (th1.150709-1700)
    FileDescription:  Microsoft Edge Content Process
    LegalCopyright:   � Microsoft Corporation. All rights reserved.
1:052> !heap -p -a 0xF050FFC
    address 0f050ffc found in
    _DPH_HEAP_ROOT @ 4e01000
    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                    ef42d9c:          f050000             2000
    6e0b9cd2 verifier!AVrfDebugPageHeapFree+0x000000c2
    77eb2e20 ntdll!RtlDebugFreeHeap+0x0000003c
    77e6e0da ntdll!RtlpFreeHeap+0x0006c97a
    77e65d2c ntdll!RtlpFreeHeapInternal+0x0000027e
    77e00a3c ntdll!RtlFreeHeap+0x0000002c
    62658b1d EDGEHTML!MemoryProtection::HeapFree+0x0000004d
    62f060c3 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x000001cc
    62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
    6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
    6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
    6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
    6258a5b0 EDGEHTML!CTreeNode::CacheStyleForLayout+0x00000030
    62f06077 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000180
    62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x00000096
    6293f7b6 EDGEHTML!CGeneratedElement::ComputeFormats+0x00354df6
    6266f1a7 EDGEHTML!CTreeNode::ComputeFormats+0x00000287
    6266de78 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x00000048
    62950cd3 EDGEHTML!Layout::ContentReader::GetNearestBlockLevelAncestor+0x0032c793
    625e2ded EDGEHTML!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree+0x000000bf
    624d119b EDGEHTML!Tree::ElementNode::CreateWrapperElement+0x00000020
    62f061e0 EDGEHTML!Tree::FirstLetterBuilder::CreateFirstLetterContainer+0x000000c1
    62efd418 EDGEHTML!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers+0x00000058
    6294f6e7 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f0c7
    626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
    62efd59f EDGEHTML!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer+0x00000117
    6294f6b6 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x0032f096
    626244b3 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0x000000c3
    62627c79 EDGEHTML!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask+0x00000059
    626273e7 EDGEHTML!Layout::FlowBoxBuilder::MoveToNextPosition+0x00000117
    62626d1d EDGEHTML!Layout::LayoutBuilderDriver::BuildPageLayout+0x000004cd
    624f0201 EDGEHTML!Layout::PageCollection::FormatPage+0x0000010e
    62520c1d EDGEHTML!Layout::PageCollection::LayoutPagesCore+0x0000026d

 
1:052> kn 0x14
 # ChildEBP RetAddr  
00 096ac10c 62f060c3 EDGEHTML!CMarkup::EnsureDeleteCFState+0xd
01 096ac158 62f05d21 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x1cc
02 096ac1b8 6293f7b6 EDGEHTML!Tree::FirstLetterBuilder::ComputeFirstLetterFormats+0x96
03 096ac240 6266f1a7 EDGEHTML!CGeneratedElement::ComputeFormats+0x354df6
04 096ac2e4 6266de78 EDGEHTML!CTreeNode::ComputeFormats+0x287
05 096acde8 62950cd3 EDGEHTML!CTreeNode::ComputeFormatsHelper+0x48
06 096ace18 625e2ded EDGEHTML!Layout::ContentReader::GetNearestBlockLevelAncestor+0x32c793
07 096ace58 624d119b EDGEHTML!Tree::TreeWriter::CreateNewNodeAndInsertIntoTree+0xbf
08 096ace84 62f061e0 EDGEHTML!Tree::ElementNode::CreateWrapperElement+0x20
09 096acea8 62efd418 EDGEHTML!Tree::FirstLetterBuilder::CreateFirstLetterContainer+0xc1
0a 096aced8 6294f6e7 EDGEHTML!Tree::FirstLetterBuilder::CreateAllFirstLetterContainers+0x58
0b 096acef8 626244b3 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x32f0c7
0c 096acf10 62efd59f EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0xc3
0d 096acf30 6294f6b6 EDGEHTML!Tree::FirstLetterBuilder::FindPlaceToCreateFirstLetterContainer+0x117
0e 096acf58 626244b3 EDGEHTML!Tree::FirstLetterBuilder::EnsureFirstLetterElement+0x32f096
0f 096acf70 62627c79 EDGEHTML!Tree::ComputedContent::EnsureSchemaFixupAndComputedBlock+0xc3
10 096acf90 626273e7 EDGEHTML!Layout::FlowBoxBuilder::SContentReader::TransitionBuilderToNextFormattingTask+0x59
11 096acff4 62626d1d EDGEHTML!Layout::FlowBoxBuilder::MoveToNextPosition+0x117
12 096ad04c 624f0201 EDGEHTML!Layout::LayoutBuilderDriver::BuildPageLayout+0x4cd
13 096ad0fc 62520c1d EDGEHTML!Layout::PageCollection::FormatPage+0x10e
1:052>