Segmentation fault (core dumped)

ChakraCore version:
commit https://github.com/chakra-core/ChakraCore/commit/c3ead3f8a6e0bb8e32e043adc091c68cba5935e9

Build cmd:
```
./build.sh --debug --static
```

Test case:
```js
function foo(){

function* bar(a,...b)
{
let x = 1;

for (let i = x; i < 8; i = i + x) {
const j = (-536870912)[-2147483648];
}
}

const m = bar();
const n = Promise.allSettled(m);
return m;
}

for(let i=0; i<0x300; i++){
foo();
}
```

The top backtrace
```
#0 0x00000009ffffffff in ?? ()
#1 0x00005555558a4064 in Js::RecyclableObject::IsExternal (this=0x7ff7f4371800)
at ChakraCore/lib/Jsrt/../Runtime/Types/RecyclableObject.inl:28
#2 0x0000555556032383 in Js::JavascriptOperators::GetTypeId (obj=0x7ff7f4371800)
at ChakraCore/lib/Runtime/./Language/JavascriptOperators.inl:14
#3 Js::JavascriptOperators::GetTypeId (aValue=0x7ff7f4371800)
at ChakraCore/lib/Runtime/./Language/JavascriptOperators.inl:34
#4 Js::JavascriptOperators::GetElementIIntIndex (instance=0x7ff7f4371800, index=0x1000080000000, scriptContext=0x555557eeab78)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:3704
#5 0x0000555556031d18 in Js::JavascriptOperators::OP_GetElementI (instance=0x7ff7f4371800, index=0x1000080000000, scriptContext=0x555557eeab78)
at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:3996
#6 0x0000555556031cc3 in Js::JavascriptOperators::OP_GetElementI_JIT (instance=0x7ff7f4371800, index=0x1000080000000, ) at ChakraCore/lib/Runtime/Language/JavascriptOperators.cpp:3637

```