Assertion failure: (!GetIsLocked()) in ChakraCore/lib/Runtime/Types/SimpleTypeHandler.cpp Js::SimpleTypeHandler::DeleteProperty, line 664

## Version
commit id: c3ead3f8a6e0bb8e32e043adc091c68cbarg1935e9

## Platform
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

## Build
- Debug Mode

```
./build.sh --debug --static
```

## PoC
```
function opt(){}
for (let i = 0; i < 100; i++) {
opt[3] = 99
for (const j in opt) {
delete opt.length;
}
}
```

## Execution steps & Output
```
./ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- poc.js
ASSERTION 358547: (/home/wjm/ChakraCore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 664) !GetIsLocked()
Failure: (!GetIsLocked())
Signal: SIGILL (Illegal instruction)
```
## Backtrace
```
(lldb) run
Process 357882 launched: '/home/wjm/ChakraCore/cmake-build-debug/ch' (x86_64)
ASSERTION 357882: (/home/wjm/ChakraCore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 664) !GetIsLocked()
Failure: (!GetIsLocked())
Process 357882 stopped
* thread #1, name = 'ch', stop reason = signal SIGILL: illegal instruction operand
frame #0: 0x00005555565c99fc ch`Js::SimpleTypeHandler<3ul>::DeleteProperty(this=0x00007ff7e7c767d0, instance=0x00007ff7e7c76780, propertyId=209, propertyOperationFlags=PropertyOperation_None) at SimpleTypeHandler.cpp:664:17
661 if (descriptors[index].Attributes & PropertyDeleted)
662 {
663 // A locked type should not have deleted properties
-> 664 Assert(!GetIsLocked());
665 return true;
666 }
667 if (!(descriptors[index].Attributes & PropertyConfigurable))
(lldb) thread backtrace
* thread #1, name = 'ch', stop reason = signal SIGILL: illegal instruction operand
* frame #0: 0x00005555565c99fc ch`Js::SimpleTypeHandler<3ul>::DeleteProperty(this=0x00007ff7e7c767d0, instance=0x00007ff7e7c76780, propertyId=209, propertyOperationFlags=PropertyOperation_None) at SimpleTypeHandler.cpp:664:17
frame #1: 0x00005555564d6573 ch`Js::DynamicObject::DeleteProperty(this=0x00007ff7e7c76780, propertyId=209, flags=PropertyOperation_None) at DynamicType.cpp:336:34
frame #2: 0x00005555561d4e6e ch`Js::JavascriptFunction::DeleteProperty(this=0x00007ff7e7c76780, propertyId=209, flags=PropertyOperation_None) at JavascriptFunction.cpp:3055:38
frame #3: 0x0000555556051278 ch`int Js::JavascriptOperators::DeleteProperty_Impl(instance=0x00007ff7e7c76780, propertyId=209, propertyOperationFlags=PropertyOperation_None) at JavascriptOperators.cpp:3129:27
frame #4: 0x0000555556030601 ch`Js::JavascriptOperators::DeleteProperty(instance=0x00007ff7e7c76780, propertyId=209, propertyOperationFlags=PropertyOperation_None) at JavascriptOperators.cpp:3073:16
frame #5: 0x00005555560307c1 ch`Js::JavascriptOperators::OP_DeleteProperty(instance=0x00007ff7e7c76780, propertyId=209, scriptContext=0x0000555557ee8fc8, propertyOperationFlags=PropertyOperation_None) at JavascriptOperators.cpp:3148:13
frame #6: 0x0000555555fb7651 ch`void Js::InterpreterStackFrame::OP_DeleteFld > __unaligned>(this=0x00007fffffffbf50, playout=0x00007ff7e7bf8071)0> > __unaligned const __unaligned*) at InterpreterStackFrame.cpp:7682:22
frame #7: 0x0000555555e7638d ch`Js::InterpreterStackFrame::ProcessUnprofiled(this=0x00007fffffffbf50) at InterpreterHandler.inl:191:3
frame #8: 0x0000555555e522be ch`Js::InterpreterStackFrame::Process(this=0x00007fffffffbf50) at InterpreterStackFrame.cpp:3495:22
frame #9: 0x0000555555e50dd3 ch`Js::InterpreterStackFrame::InterpreterHelper(function=0x00007ff7e7c76730, args=ArgumentReader @ 0x00007fffffffc530, returnAddress=0x00007ff7e7bd0fa2, addressOfReturnAddress=0x00007fffffffc578, asmJsReturn=0x0000000000000000) at InterpreterStackFrame.cpp:2153:40
frame #10: 0x0000555555e4feb0 ch`Js::InterpreterStackFrame::InterpreterThunk(layout=0x00007fffffffc590) at InterpreterStackFrame.cpp:1833:16
frame #11: 0x00007ff7e7bd0fa2
frame #12: 0x00005555564a37de ch`amd64_CallFunction at JavascriptFunctionA.S:100
frame #13: 0x00005555561d7a4b ch`void* Js::JavascriptFunction::CallFunction(function=0x00007ff7e7c76730, entryPoint=(ch`NativeCodeGenerator::CheckCodeGenThunk(Js::RecyclableObject*, Js::CallInfo, ...)), args=Arguments @ 0x00007fffffffc798, useLargeArgCount=false)(Js::RecyclableObject*, Js::CallInfo, ...), Js::Arguments, bool) at JavascriptFunction.cpp:1364:16
frame #14: 0x00005555561cf2f4 ch`Js::JavascriptFunction::CallRootFunctionInternal(obj=0x00007ff7e7c76730, args=Arguments @ 0x00007fffffffc810, scriptContext=0x0000555557ee8fc8, inScript=true) at JavascriptFunction.cpp:772:24
frame #15: 0x00005555561cf10c ch`Js::JavascriptFunction::CallRootFunction(obj=0x00007ff7e7c76730, args=, scriptContext=0x0000555557ee8fc8, inScript=true) at JavascriptFunction.cpp:717:15
frame #16: 0x00005555561cf0b1 ch`Js::JavascriptFunction::CallRootFunction(this=0x00007ff7e7c76730, args=, scriptContext=0x0000555557ee8fc8, inScript=true) at JavascriptFunction.cpp:832:16
frame #17: 0x0000555555894a8e ch`RunScriptCore(this=0x00007fffffffcbe0, scriptContext=0x0000555557ee8fc8, _actionEntryPopper=0x00007fffffffcbc0)::$_85::operator()(Js::ScriptContext*, TTD::TTDJsRTActionResultAutoRecorder&) const at Jsrt.cpp:3705:49
frame #18: 0x0000555555894624 ch`_JsErrorCode ContextAPIWrapper(this=0x00007fffffffcb78, scriptContext=0x0000555557ee8fc8)::$_85)::'lambda'(Js::ScriptContext*)::operator()(Js::ScriptContext*) const at JsrtInternal.h:237:16
frame #19: 0x0000555555893fc4 ch`_JsErrorCode ContextAPIWrapper_Core(RunScriptCore(void*, unsigned char const*, unsigned long, LoadScriptFlag, unsigned long, char16_t const*, bool, _JsParseScriptAttributes, bool, void**)::$_85)::'lambda'(Js::ScriptContext*)>(fn=(anonymous class) @ 0x00007fffffffcb78)::$_85) at JsrtInternal.h:192:23
frame #20: 0x00005555558608f6 ch`_JsErrorCode ContextAPIWrapper(fn=(anonymous class) @ 0x00007fffffffcbe0)::$_85) at JsrtInternal.h:235:27
frame #21: 0x00005555558607fb ch`RunScriptCore(scriptSource=0x00007ff7e7c44000, script="function f1(a2, a3, a4, a5) {\n a5[1799493994] = 99;\n return a5;\n}\nfor (let v6 = 0; v6 < 100; v6++) {\n const v8 = f1(v6, v6, v6 == 99, f1);\n for (const v9 in v8) {\n delete v8.length;\n }\n}\n// CRASH INFO\n// ==========\n// TERMSIG: 4\n// STDERR:\n// ASSERTION 3460092: (/home/wjm/ChakraCore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 664) !GetIsLocked()\n// Failure: (!GetIsLocked())\n// STDOUT:\n// ARGS: /home/wjm/ChakraCore/out/Debug/ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- -reprl fuzzcode.js\n// EXECUTION TIME: 87 ms\n\n/*\n\nTitle: \n\n## Version\ncommit id: c3ead3f8a6e0bb8e32e043adc091c68cba5935e9\n\n## Platform\nUbuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)\n\n## Build\n- Debug Mode\n\n```\n./build.sh --debug --static\n```\n\n## PoC\n```\n\n```\n\n## Execution steps & Output\n```\n./ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- poc.js\nAborted (core dumped)\n```\n## Backtrace\n```\n\n\n```\n\n*\/", cb=932, loadScriptFlag=LoadScriptFlag_Utf8Source | LoadScriptFlag_ExternalArrayBuffer, sourceContext=0, sourceUrl=u"/home/wjm/DiTing-pocs/chakra/bug04_typeHandler.js", parseOnly=false, parseAttributes=JsParseScriptAttributeNone, isSourceModule=false, result=0x0000000000000000) at Jsrt.cpp:3656:12
frame #22: 0x0000555555862f6e ch`::JsRun(JsValueRef, JsSourceContext, JsValueRef, JsParseScriptAttributes, JsValueRef *) [inlined] CompileRun(scriptVal=0x00007ff7e7c44000, sourceContext=0, sourceUrl=0x00007ff7e7c71cf0, parseAttributes=JsParseScriptAttributeNone, result=0x0000000000000000, parseOnly=false) at Jsrt.cpp:5019:12
frame #23: 0x0000555555862db9 ch`::JsRun(scriptVal=0x00007ff7e7c44000, sourceContext=0, sourceUrl=0x00007ff7e7c71cf0, parseAttributes=JsParseScriptAttributeNone, result=0x0000000000000000) at Jsrt.cpp:5041
frame #24: 0x0000555555787293 ch`ChakraRTInterface::JsRun(script=0x00007ff7e7c44000, sourceContext=0, sourceUrl=0x00007ff7e7c71cf0, parseAttributes=JsParseScriptAttributeNone, result=0x0000000000000000) at ChakraRtInterface.h:487:179
frame #25: 0x0000555555784924 ch`RunScript(fileName="bug04_typeHandler.js", fileContents="function f1(a2, a3, a4, a5) {\n a5[1799493994] = 99;\n return a5;\n}\nfor (let v6 = 0; v6 < 100; v6++) {\n const v8 = f1(v6, v6, v6 == 99, f1);\n for (const v9 in v8) {\n delete v8.length;\n }\n}\n// CRASH INFO\n// ==========\n// TERMSIG: 4\n// STDERR:\n// ASSERTION 3460092: (/home/wjm/ChakraCore/lib/Runtime/Types/SimpleTypeHandler.cpp, line 664) !GetIsLocked()\n// Failure: (!GetIsLocked())\n// STDOUT:\n// ARGS: /home/wjm/ChakraCore/out/Debug/ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- -reprl fuzzcode.js\n// EXECUTION TIME: 87 ms\n\n/*\n\nTitle: \n\n## Version\ncommit id: c3ead3f8a6e0bb8e32e043adc091c68cba5935e9\n\n## Platform\nUbuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)\n\n## Build\n- Debug Mode\n\n```\n./build.sh --debug --static\n```\n\n## PoC\n```\n\n```\n\n## Execution steps & Output\n```\n./ch --maxinterpretcount:10 --maxsimplejitruncount:100 -bgjit- poc.js\nAborted (core dumped)\n```\n## Backtrace\n```\n\n\n```\n\n*\/", fileLength=932, fileContentsFinalizeCallback=(ch`WScriptJsrt::FinalizeFree(void*) at WScriptJsrt.cpp:217), bufferValue=0x0000000000000000, fullPath="/home/wjm/DiTing-pocs/chakra/bug04_typeHandler.js", parserStateCache=0x0000000000000000)(void*), void*, char*, void*) at ch.cpp:451:25
frame #26: 0x00005555557863f0 ch`ExecuteTest(fileName="bug04_typeHandler.js") at ch.cpp:917:13
frame #27: 0x00005555557864ac ch`ExecuteTestWithMemoryCheck(fileName="bug04_typeHandler.js") at ch.cpp:967:10
frame #28: 0x0000555555786d7a ch`main(argc=5, c_argv=0x00007fffffffd648) at ch.cpp:1274:20
frame #29: 0x00007ffff778d1e2 libc.so.6`__libc_start_main + 242
frame #30: 0x0000555555783b7e ch`_start + 46
```