Steps to reproduce
This is a use-after-free bug that is mitigated by MemGC; it results in a NULL pointer crash with MemGC enabled.
Comments and activity
- Microsoft Edge Team
Changed Assigned To to “Ibrahim O.”
Changed Assigned To to “Travis L.”
Changed Title from “Free 0b9.86a @ microsoftedgecp.exe!edgehtml.dll!COpenElements::Push” to “Free 0b9.86a @ microsoftedgecp.exe!edgehtml.dll!COpenElements::Push”
Changed Assigned To from “Travis L.” to “Jeff W.”
Changed Status to “Confirmed”
Changed Status from “Confirmed” to “In code review”
Changed Status from “In code review” to “Fixed”
This should be fixed in an upcoming flight. Thanks for the report!