Crash in Enterprise mode with binary behavior

Fixed Issue #172641


May 5, 2014
This issue is public.
Found in build #
Fixed in build #
Reported by 0 people

Sign in to watch or report this issue.

Steps to reproduce



Repro Steps:

  1. Enable Enterprise mode in IE. If it is not already enabled, use regedit to add the key
    [HKEY_LOCAL_MACHINE\SOFTWARE\ Policies\Microsoft\Internet Explorer\Main\EnterpriseMode]
    with string value “Enable”="” (i.e., don’t give it a value).
    See for more details
  1. Download and install MathPlayer from
  1. Visit the MathPlayer install check page You should get a warning that MathPlayer requires version 6-9 of IE.
  1. Turn on enterprise mode for that page by selecting the Tools menu item "Enterprise mode". If the tool bar with the “Tools” menu is not visible, hit the alt key to display it. The page with the warning should go away immediately after enabling enterprise mode and be replaced by a page that will say you have installed the latest version of MathPlayer; there will be some nicely displayed math. If you right click on the math, you’ll see a menu that contains "speak expression". That shows off the accessibility.
  1. Go to Two math equations should display in the upper right side (it uses HTML+CSS positioning, not MathPlayer). It is not accessible.
  1. Turn on enterprise mode for the MathJax page (as in step 4). IE will crash. I have verified in a debugger that the crash is in IE. Here is the top of the stack trace:
    mshtml.dll!Tree::ElementNode::SetContentMeasure() + 0x10 bytes
    mshtml.dll!CBackgroundInfo::Property<CBackgroundImage>&#39;::7’::`dynamic atexit destructor for ‘fieldDefaultValue’’() + 0xb7e6e bytes
    mshtml.dll!Layout::SBoxModel::CalculateFullBoxModelForReplaced() + 0x24b213 bytes
    mshtml.dll!Layout::SBoxModel::CalculateFullBoxModel() + 0x191b8d bytes
    mshtml.dll!Layout::FlowBoxBuilder::BuildBoxItem() + 0x4be94 bytes

Expected Results:

The expected behavior is that displays without the crash and will be accessible to AT when MathPlayer is installed and enterprise mode is enabled for that page.

If you run the IE8 browser and follow the steps below (of course skipping turning on enterprise mode), the page will display normally and the math will display via MathPlayer and be accessible.

If you use IE11 and use the developer tool to set the document mode to IE5 or IE7, the page will display normally. If you set the page to IE8 mode, it will crash.

Actual Results:


0 attachments

    Comments and activity

    • Microsoft Edge Team

      Changed Assigned To to “Tony S.”

      Changed Status to “Confirmed”

      Changed Assigned To from “Tony S.” to “Corey B.”

      Changed Assigned To from “Corey B.” to “Nicole B.”

      Changed Assigned To from “Nicole B.” to “Corey B.”

      Changed Assigned To from “Corey B.” to “IPBS P.”

      Changed Status from “Confirmed” to “Won’t fix”

      Changed Assigned To from “IPBS P.” to “Tony S.”

      Changed Assigned To from “Tony S.” to “Jonathan H.”

      Changed Status from “Won’t fix”

      Changed Assigned To from “Jonathan H.” to “Corey B.”

      Changed Status to “In code review”

      Changed Status from “In code review” to “In progress”

      Changed Assigned To from “Corey B.” to “IPBS P.”

      Changed Status from “In progress” to “Fixed”

      Changed Assigned To from “IPBS P.” to “Rossen A.”

    You need to sign in to your Microsoft account to add a comment.

    Sign in