Heap-data disclosure via unrooted BigInt operands

Use-after-free in BigInt addition in Meta Hermes before commit a6dcafe allows attackers to read raw data from the VM heap. In addOp_RJS, operand conversion can invoke attacker-controlled JavaScript and garbage collection, while addition later dereferences BigInts obtained from conversion results that are not kept rooted; the patch instead uses rooted primitive handles. When Hermes executes untrusted JavaScript, crafted coercion during BigInt addition can expose stale heap contents; most React Native applications do not execute untrusted JavaScript and are not affected.