null pointer dereference in Js::RecyclableObject::GetType

the following poc can trigger a null pointer dereference.
````
function f() {
try {
throw 1;
} catch ({a = f.__proto__.__proto__=a}) {
}
}

f();
````

Start by running the provided JavaScript proof of concept and tracing the failure at Js::RecyclableObject::GetType. Determine the missing null handling in that entry point; done means the proof of concept no longer triggers a null pointer dereference.

Written by the indexing model from the issue text.