Assertion failure in OutputPropertyValue<T>::impl

Hello, executing following code in ch 1.11.24(debug), an assertion will be thrown.
```
'use strict';
function func(arr) {
var a = new Promise(function() {});
arr.__proto__.__proto__ = a;
}

for (var i = 0; i < 2; i++) {
var arr = [
,
{}
];
Object.prototype.toString.call(Array());
func(arr);
}
```
output:
```
ASSERTION 14228: (c:\users\sunlili\documents\workspace\jsenginesfordebug\chakracore-1.11.24\lib\runtime\language\inlinecache.h, line 471) *propertyValue == slowPathValue || (RootObjectBase::Is(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal())
Failure: (*propertyValue == slowPathValue || (RootObjectBase::Is(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal()))
FATAL ERROR: ch.exe failed due to exception code c0000420
```

The assertion is triggered when the second time executing `Object.prototype.toString.call(Array())`. According to [http://www.ecma-international.org/ecma-262/#sec-object.prototype.tostring], toString should get `@@toStringTag`.
https://github.com/microsoft/ChakraCore/blob/7d4bdd821d452d6b91a21936257d7e352ea7dc4b/lib/Runtime/Library/JavascriptObject.cpp#L444-L445
Since Array does not contain `@@toStringTag`, `undefined` is fetched for the first time, and the value is stored in inline cache. After calling `func(arr)`, Array contains `@@toStringTag`, which is inherited by the Promise object. However, the value in inline cache is not invalid. When `Object.prototype.toString.call(Array())` is executed again, the assertion is triggered and the old value `undefined` is fetched.

ISec Lab.
2020.12.16