
MSEdge: Type confusion in HandleColumnBreakOnColumnSpanningElement - etimberg
https://bugs.chromium.org/p/project-zero/issues/detail?id=1011
======
Const-me
Confirmed in IE.

MS Edge however doesn’t crash. It refuses to show the page, but the debugger
shows what looks like a normal JavaScript exception during a JS function call.
Edge catches that exception just fine.

> Microsoft Edge and 32-bit IE 11 should behave similarly

No, google, they should not. The two are almost completely different.

Live demo: [http://const.me/tmp/test.html](http://const.me/tmp/test.html)

Call stack from Edge: [http://const.me/tmp/edge-
stack.txt](http://const.me/tmp/edge-stack.txt)

