Assertion `IDom && "Reached the top of the tree!"' failed in ./hermes/lib/Optimizer/Scalar/Mem2Reg.cpp

## Bug Description

Hermes git revision (if applicable): https://github.com/facebook/hermes/commit/75cdee98363191d31b6a1cdc766926f8d120364b
React Native version: N/A
OS: Ubuntu 20.04.5 LTS (Linux 5.4.0-144-generic x86_64)
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): x86_64

## Steps To Reproduce

###### Build steps
```sh
cmake -S hermes -B build -G Ninja
cmake --build ./build
```

###### Test case
testcase

```javascript
let r = [ ] ;
for ( let t = 0 ; t * 10 < 2500 ; ++ t ) {
t += t * 10 ;
print ( " 0 one - two - three - four - a " + " a " ) ;
r. push ( 1 << t + " a " + ( " " + t ) ) ;
r. pop ( ) ;
r. push ( " " + t ) ;
}
r. some ( ( { [ t ] : t }, e ) => {
r. splice ( ) ;
r [ r. length - 1 ] = { [ e ] : t % 128 } ;
r [ r. length ] ++ ;
return e < t | t - e == 1 << e ;
}
) ;
```

```javascript
// poc.js
r. some ( ( { [ t ] : t } ) => { } ) ;
```

###### Execution steps & Output
```
$ ./hermes poc.js
hermes: ./hermes/lib/Optimizer/Scalar/Mem2Reg.cpp:590: hermes::Value* getLiveInValue(hermes::BasicBlock*, BlockToInstMap&, hermes::DominanceInfo&, BlockToInstMap&): Assertion `IDom && "Reached the top of the tree!"' failed.
Aborted
```

###### Backtrace
```
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007ffff753f859 in __GI_abort () at abort.c:79
#2 0x00007ffff753f729 in __assert_fail_base (fmt=0x7ffff76d5588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x555555f8e1c8 "IDom && \"Reached the top of the tree!\"", file=0x555555f8e138 "./hermes/lib/Optimizer/Scalar/Mem2Reg.cpp",
line=590, function=) at assert.c:92
#3 0x00007ffff7550fd6 in __GI___assert_fail (assertion=0x555555f8e1c8 "IDom && \"Reached the top of the tree!\"", file=0x555555f8e138 "./hermes/lib/Optimizer/Scalar/Mem2Reg.cpp", line=590,
function=0x555555f8e0c8 "hermes::Value* getLiveInValue(hermes::BasicBlock*, BlockToInstMap&, hermes::DominanceInfo&, BlockToInstMap&)") at assert.c:101
#4 0x0000555555a950c6 in getLiveInValue (BB=0x5555563ebf80, phiLoc=..., DT=..., stores=...) at ./hermes/lib/Optimizer/Scalar/Mem2Reg.cpp:590
#5 0x0000555555a95e3c in promoteAllocStackToSSA (ASI=0x5555563ea6e0, DT=..., domTreeLevels=...) at ./hermes/lib/Optimizer/Scalar/Mem2Reg.cpp:734
#6 0x0000555555a963ff in hermes::Mem2Reg::runOnFunction (this=0x5555563eb800, F=0x5555563ebe40) at ./hermes/lib/Optimizer/Scalar/Mem2Reg.cpp:785
#7 0x0000555555a84739 in hermes::PassManager::run (this=0x7fffffffd1c0, M=0x7fffffffd9e0) at ./hermes/lib/Optimizer/PassManager/PassManager.cpp:203
#8 0x0000555555a899f7 in hermes::runFullOptimizationPasses (M=...) at ./hermes/lib/Optimizer/PassManager/Pipeline.cpp:102
#9 0x00005555558c28d0 in (anonymous namespace)::processSourceFiles (context=std::shared_ptr (use count 3, weak count 0) = {...}, Python Exception 'NoneType' object has no attribute 'pointer':
fileBufs=std::map with 1 element) at ./hermes/lib/CompilerDriver/CompilerDriver.cpp:2015
#10 0x00005555558c420a in hermes::driver::compileFromCommandLineOptions () at ./hermes/lib/CompilerDriver/CompilerDriver.cpp:2291
#11 0x000055555557aad4 in main (argc=2, argv=0x7fffffffe328) at ./hermes/tools/hermes/hermes.cpp:202
```

---
when executed in release mode

**Output**
```
Segmentation fault
```

## The Expected Behavior
This code should not crash.
Other JS engines (such as V8, JSC, etc.) identify a ReferenceError.
```
poc.js:1: ReferenceError: r is not defined
r. some ( ( { [ t ] : t } ) => { } ) ;
^
ReferenceError: r is not defined
at poc.js:1:1
```

Credits: @Ye0nny, @EJueon