Document.evaluate for error-free documents namespaceURI Microsoft Edge

Question

Tested on Microsoft Edge from Windows 10 build 10240. Fixed in assembly 10586.

Summary

Running XMLDocument.prototype.evaluate in a document with namespaceURI set to null crashes the current tab process in Microsoft Edge, leaving the developer tools for this tab unresponsive, sends debugging information to watson.telemetry.microsoft.com and forces the page to reload.

Repro

To play, open any website in Microsoft Edge, press F12 to open the developer tools, select "Console" and run these three lines of javascript:

 var doc = document.implementation.createDocument(null, null, null); var node = doc.createElement('A'); doc.evaluate('B', node, doc.createNSResolver(doc), 9, null); 

Answer 1

Bypass

Open the baseURI node context property before running evaluate .

 var doc = document.implementation.createDocument(null, null, null); var node = doc.createElement('A'); node.baseURI; // Edge workaround http://stackoverflow.com/q/33887400/823663 doc.evaluate('B', node, doc.createNSResolver(doc), 9, null);