Microsoft Edge - TypedArray.sort Use-After-Free (MS16-145)

!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=983 There is a use-after-free in TypedArray.sort. In TypedArrayCompareElementsHelper https://chromium.googlesource.com/external/github.com/Microsoft/ChakraCore/+/TimeTravelDebugging/lib/Runtime/Library/TypedArray.cpp, the...