Microsoft Edge Charka JIT Incomplete Fix For Issue 1420 #2

Title: Microsoft Edge: Chakra: JIT: The fix for issue 1420 is incomplete 2 CVE-2018-0934 Here's a snippet of JavascriptArray::BoxStackInstance. template T JavascriptArray::BoxStackInstanceT instance, bool deepCopy AssertThreadContext::IsOnStackinstance; // On the stack, the we reserved a pointer...