Assertion fail: Js reentrancy error

Version: `ch version 1.12.0.0-beta`

Git hash: `33db8efd9f02cd528a7305391d7d10765a2e85f3`

POC:
```javascript
function a(b) {
c = {...b, __proto__ : Intl }
}
a()
```

Stack dump:
```
#0 0x000055555579bb41 in ReportFatalException ()
#1 0x000055555579bdc7 in Js::Throw::FatalJsReentrancyError() ()
#2 0x0000555555a2ae79 in void* Js::JavascriptFunction::CallFunction(Js::RecyclableObject*, void* (*)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool)
()
#3 0x0000555555a26f5e in Js::JavascriptFunction::CallRootFunctionInScript(Js::JavascriptFunction*, Js::Arguments) ()
#4 0x0000555555d30d3d in Js::IntlEngineInterfaceExtensionObject::InjectIntlLibraryCode(Js::ScriptContext*, Js::DynamicObject*, Js::IntlInitializationType) ()
#5 0x0000555555a4b40f in Js::JavascriptLibrary::InitializeIntlObject(Js::DynamicObject*, Js::DeferredTypeHandlerBase*, Js::DeferredInitializeMode) ()
#6 0x0000555555ae67c0 in Js::DeferredTypeHandler<&Js::JavascriptLibrary::InitializeIntlObject, Js::DefaultDeferredTypeFilter, true, (unsigned short)0, (unsigned short)0>::GetProperty(Js::DynamicObject*, void*, int, void**, Js::PropertyValueInfo*, Js::ScriptContext*) ()
#7 0x0000555555bafda2 in Js::DynamicObject::GetInternalProperty(void*, int, void**, Js::PropertyValueInfo*, Js::ScriptContext*) ()
#8 0x0000555555bbe933 in Js::PathTypeHandlerBase::SetPrototype(Js::DynamicObject*, Js::RecyclableObject*) ()
#9 0x0000555555b28069 in Js::JavascriptObject::ChangePrototype(Js::RecyclableObject*, Js::RecyclableObject*, bool, Js::ScriptContext*) ()
#10 0x0000555555981fb5 in Js::JavascriptOperators::OP_InitProto(void*, int, void*) ()
#11 0x00005555558fdaec in Js::InterpreterStackFrame::ProcessProfiledExtendedOpcodePrefix(unsigned char const*) ()
#12 0x000055555590dece in Js::InterpreterStackFrame::ProcessProfiled() ()
#13 0x00005555558ee5d3 in Js::InterpreterStackFrame::Process() ()
#14 0x00005555558eddab in Js::InterpreterStackFrame::InterpreterHelper(Js::ScriptFunction*, Js::ArgumentReader, void*, void*, Js::InterpreterStackFrame::AsmJsReturnStruct*)
()
#15 0x00005555558ed865 in Js::InterpreterStackFrame::InterpreterThunk(Js::JavascriptCallStackLayout*) ()
```