ASSERTION (lifetime->start < instr->GetNumber() && lifetime->end >= instr->GetNumber()) failed in LinearScan::SpillInlineeArgs(IR::Instr*)::$_3::operator

###### ChakraCore version:

```
Checked revision: 62d3d1163
Build command: ./build.sh --debug
```

###### OS:

```
Linux-4.15.0-43-generic-x86_64-with-Ubuntu-18.04-bionic
```

###### Test case:

```js
var all = [ ]
function AsmModuleDouble ( ) {
function LtFloat ( ) {}
function GeFloat ( ) {
if (Promise == 91)
while (1) $ = 0
}
return { $ : LtFloat , Ge : GeFloat }
}

var asmModuleDouble = AsmModuleDouble();
for ( var i ; ; ) {
for ( var j ; ; ) {
print( 0 + i + 0 + all [ i ] + 0 + j + 0 + all [ j ] + 0 + (asmModuleDouble.Ge() ) );
}
}
```

###### Backtrace:

```text
0x00007ffff2bf24ff in LinearScan::SpillInlineeArgs(IR::Instr*)::$_3::operator()(unsigned int, Lifetime*) const (
this=0x7ff7f16926b0, i=0, lifetime=0x7ff7f0646db0) at ChakraCore/lib/Backend/LinearScan.cpp:3408
3408 Assert(lifetime->start < instr->GetNumber() && lifetime->end >= instr->GetNumber());
(gdb) bt
#0 0x00007ffff2bf24ff in LinearScan::SpillInlineeArgs(IR::Instr*)::$_3::operator()(unsigned int, Lifetime*) const (
this=0x7ff7f16926b0, i=0, lifetime=0x7ff7f0646db0) at ChakraCore/lib/Backend/LinearScan.cpp:3408
#1 0x00007ffff2bf23f9 in JsUtil::List::MapFrom(int, LinearScan::SpillInlineeArgs(IR::Instr*)::$_3) const (this=0x7ff7f05d14b0,
start=0, map=...) at ChakraCore/lib/Common/DataStructures/List.h:564
#2 0x00007ffff2bee52f in JsUtil::List::Map(LinearScan::SpillInlineeArgs(IR::Instr*)::$_3) const (this=0x7ff7f05d14b0, map=...)
at ChakraCore/lib/Common/DataStructures/List.h:542
#3 0x00007ffff2beac4a in LinearScan::SpillInlineeArgs (this=0x7ff7f1693198, instr=0x7ff7f0687af0)
at ChakraCore/lib/Backend/LinearScan.cpp:3407
#4 0x00007ffff2be18ab in LinearScan::KillImplicitRegs (this=0x7ff7f1693198, instr=0x7ff7f0687af0)
at ChakraCore/lib/Backend/LinearScan.cpp:3363
#5 0x00007ffff2bda49a in LinearScan::RegAlloc (this=0x7ff7f1693198)
at ChakraCore/lib/Backend/LinearScan.cpp:275
#6 0x00007ffff2963f63 in Func::TryCodegen (this=0x7ff7f1693ee0) at ChakraCore/lib/Backend/Func.cpp:493
#7 0x00007ffff2963425 in Func::Codegen (alloc=0x7ff7f16944e0, workItem=0x7ff7f0671030, threadContextInfo=0x5555561837b8,
scriptContextInfo=0x5555561b2da8, outputData=0x7ff7f16949e0, epInfo=0x7ffff7ef3280, runtimeInfo=0x0,
polymorphicInlineCacheInfo=0x7ffff7e0cde0, codeGenAllocators=0x5555561b7608, codeGenProfiler=0x0, isBackgroundJIT=true)
at ChakraCore/lib/Backend/Func.cpp:323
#8 0x00007ffff2ce0309 in NativeCodeGenerator::CodeGen (this=0x5555561b47f8, pageAllocator=0x55555586e5e8,
workItemData=0x5555561cef60, jitWriteData=..., foreground=false, epInfo=0x7ffff7ef3280)
at ChakraCore/lib/Backend/NativeCodeGenerator.cpp:894
#9 0x00007ffff2ce2030 in NativeCodeGenerator::CodeGen (this=0x5555561b47f8, pageAllocator=0x55555586e5e8, workItem=
0x5555561cef38, foreground=false) at ChakraCore/lib/Backend/NativeCodeGenerator.cpp:1011
#10 0x00007ffff2ce4fa9 in NativeCodeGenerator::Process (this=0x5555561b47f8, job=0x5555561cef40, threadData=0x55555586e5c8)
at ChakraCore/lib/Backend/NativeCodeGenerator.cpp:1895
#11 0x00007ffff2d82be1 in JsUtil::BackgroundJobProcessor::Process (this=0x5555561b4968, job=0x5555561cef40,
threadData=0x55555586e5c8) at ChakraCore/lib/Common/Common/Jobs.cpp:1037
#12 0x00007ffff2d831fe in JsUtil::BackgroundJobProcessor::Run (this=0x5555561b4968, threadData=0x55555586e5c8)
at ChakraCore/lib/Common/Common/Jobs.cpp:1135
#13 0x00007ffff2d8052e in JsUtil::BackgroundJobProcessor::StaticThreadProc (lpParam=0x55555586e5c8)
at ChakraCore/lib/Common/Common/Jobs.cpp:1319
#14 0x00007ffff279b811 in CorUnix::CPalThread::ThreadEntry (pvParam=0x5555561b50e0)
at ChakraCore/pal/src/thread/pal_thread.cpp:1605
#15 0x00007ffff73656db in start_thread (arg=0x7ff7f1695700) at pthread_create.c:463
#16 0x00007ffff654b88f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```

^{Found by [Fuzzinator](http://fuzzinator.readthedocs.io/) with [grammarinator](https://github.com/renatahodovan/grammarinator).}