ASSERTION (!frameObject || VarIsCorrectType(frameObject) failed in Js::HeapArgumentsObject::HeapArgumentsObject

###### ChakraCore version:

```
Checked revision: 39f9727ef
Build command: ./build.sh --debug
```

###### OS:

```
Linux-4.15.0-43-generic-x86_64-with-Ubuntu-18.04-bionic
```

###### Test case:

```js
var tests = [0, 0];
tests.forEach(function() {
var eval = WScript.LoadScript(0, "samethread").eval;
eval(0);
});
```

###### Backtrace:

```text
ASSERTION 25988: (ChakraCore/lib/Runtime/Library/ArgumentsObject.cpp, line 38) !frameObject || VarIsCorrectType(frameObject)
Failure: (!frameObject || VarIsCorrectType(frameObject))

Thread 1 "ch" received signal SIGILL, Illegal instruction.
0x00005555583e9a62 in Js::HeapArgumentsObject::HeapArgumentsObject (this=0x7ffff1d1e580, recycler=0x632000000858, obj=
0x7ffff1d084b0, formalCount=0, type=0x7ffff1f43e40)
at ChakraCore/lib/Runtime/Library/ArgumentsObject.cpp:38
38 Assert(!frameObject || VarIsCorrectType(frameObject));
(gdb) bt
#0 0x00005555583e9a62 in Js::HeapArgumentsObject::HeapArgumentsObject (this=0x7ffff1d1e580, recycler=0x632000000858,
obj=0x7ffff1d084b0, formalCount=0, type=0x7ffff1f43e40)
at ChakraCore/lib/Runtime/Library/ArgumentsObject.cpp:38
#1 0x00005555586f2185 in Js::JavascriptLibrary::CreateHeapArguments (this=0x7ffff1f58000, frameObj=0x7ffff1d084b0, formalCount=0,
isStrictMode=false) at ChakraCore/lib/Runtime/Library/JavascriptLibrary.cpp:5555
#2 0x00005555581dedf8 in Js::JavascriptOperators::CreateHeapArguments (funcCallee=0x7ffff1d08460, actualsCount=3, formalsCount=0,
frameObj=0x7ffff1d084b0, scriptContext=0x622000000158)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:7443
#3 0x00005555581dfdfc in Js::JavascriptOperators::LoadHeapArgsCached (funcCallee=0x7ffff1d08460, actualsCount=3, formalsCount=0,
paramAddr=0x7ffffffee818, frameObj=0x7ffff1d084b0, scriptContext=0x622000000158, nonSimpleParamList=false)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:7338
#4 0x000055555801c166 in Js::InterpreterStackFrame::OP_LdHeapArgsCached (this=0x7ffffffeddc0, scriptContext=0x622000000158)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:9262
#5 0x0000555557bdb772 in Js::InterpreterStackFrame::ProcessProfiled (this=0x7ffffffeddc0)
at ChakraCore/lib/Runtime/Language/InterpreterHandler.inl:307
#6 0x0000555557a89bf0 in Js::InterpreterStackFrame::Process (this=0x7ffffffeddc0)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3357
#7 0x0000555557a86e43 in Js::InterpreterStackFrame::InterpreterHelper (function=0x7ffff1d08460, args=...,
returnAddress=0x7ffff1d60f7a, addressOfReturnAddress=0x7ffffffee7e8, asmJsReturn=0x0)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:2051
#8 0x0000555557a84c23 in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7ffffffee800)
at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:1763
#9 0x00007ffff1d60f7a in ?? ()
#10 0x00007ffffffee830 in ?? ()
#11 0x0000555558ded02e in amd64_CallFunction ()
at ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
Backtrace stopped: frame did not save the PC
```

^{Found by [Fuzzinator](http://fuzzinator.readthedocs.io/) with [grammarinator](https://github.com/renatahodovan/grammarinator).}