Microsoft Edge: Memory corruption with Object.setPrototypeOf(CVE-2017-8751)

I accidentally found this while trying to reproduce another bug in Edge. Failed to reproduce on Microsoft Edge 38.14393.1066.0, Microsoft EdgeHTML 14.14393. Tested on Microsoft Edge 40.15063.0.0, Microsoft EdgeHTML 15.15063 Insider Preview. Crash Log: First chance exceptions are reported before a...