ASSERTION (!CrossSite::NeedMarshalVar(value, GetScriptContext())) failed in Js::InterpreterStackFrame::ValidateRegValue

###### ChakraCore version:

```
Checked revision: e6e25c3a5
Build command: ./build.sh --debug
```

###### OS:

```
Linux-4.15.0-43-generic-x86_64-with-Ubuntu-18.04-bionic
```

###### Test case:

```js
var x = {};
var y = WScript.LoadScript(0, "samethread");
with(x) {
with (y) {
eval()
}
}
```

###### Backtrace:

```text
ASSERTION 24034: (ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp, line 7775) !CrossSite::NeedMarshalVar(value, GetScriptContext())
Failure: (!CrossSite::NeedMarshalVar(value, GetScriptContext()))

bt
#0 0x0000555557ffddff in Js::InterpreterStackFrame::ValidateRegValue (this=0x7fffffffa240, value=0x7ffff1db1e00, allowStackVar=false, allowStackVarOnDisabledStackNestedFunc=true) at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:7775
#1 0x0000555558006e81 in Js::InterpreterStackFrame::SetReg (this=0x7fffffffa240, localRegisterID=33 '!', value=0x7ffff1db1e00) at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:7792
#2 0x000055555812a919 in Js::InterpreterStackFrame::OP_GetMethodPropertyScoped_NoFastPath > const __unaligned>(Js::OpLayoutT_ElementCP > const __unaligned __unaligned*) (this=0x7fffffffa240, playout=0x7ffff1d900f6) at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3621
#3 0x000055555804bf13 in Js::InterpreterStackFrame::OP_GetMethodPropertyScoped > const __unaligned>(Js::OpLayoutT_ElementCP > const __unaligned __unaligned*) (this=0x7fffffffa240, playout=0x7ffff1d900f6) at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3601
#4 0x0000555557be0498 in Js::InterpreterStackFrame::ProcessProfiled (this=0x7fffffffa240) at ChakraCore/lib/Runtime/Language/InterpreterHandler.inl:351
#5 0x0000555557a89bf0 in Js::InterpreterStackFrame::Process (this=0x7fffffffa240) at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3357
#6 0x0000555557a86e43 in Js::InterpreterStackFrame::InterpreterHelper (function=0x7ffff1f566e0, args=..., returnAddress=0x7ffff1d60fa2, addressOfReturnAddress=0x7fffffffad48, asmJsReturn=0x0) at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:2051
#7 0x0000555557a84c23 in Js::InterpreterStackFrame::InterpreterThunk (layout=0x7fffffffad60) at ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:1763
#8 0x00007ffff1d60fa2 in ?? ()
#9 0x00007fffffffad70 in ?? ()
#10 0x0000555558ded02e in amd64_CallFunction () at ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
Backtrace stopped: frame did not save the PC
```

^{Found by [Fuzzinator](http://fuzzinator.readthedocs.io/) with [grammarinator](https://github.com/renatahodovan/grammarinator).}