Assertion failure in OutputPropertyValue<T>::impl

Hello, executing following code in ch 1.11.24(debug), an assertion will be thrown.

'use strict';
function func(arr) {
    var a = new Promise(function() {});
    arr.__proto__.__proto__ = a;
}

for (var i = 0; i < 2; i++) {
    var arr = [
    ,
    {}
    ];
    Object.prototype.toString.call(Array());
    func(arr);
}

output:

ASSERTION 14228: (c:\users\sunlili\documents\workspace\jsenginesfordebug\chakracore-1.11.24\lib\runtime\language\inlinecache.h, line 471) *propertyValue == slowPathValue || (RootObjectBase::Is(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal())
 Failure: (*propertyValue == slowPathValue || (RootObjectBase::Is(propertyObject) && *propertyValue == rootObjectValue) || (slowPathValue == requestContext->GetLibrary()->GetNull() && requestContext->GetThreadContext()->IsDisableImplicitCall() && propertyObject->GetType()->IsExternal()))
FATAL ERROR: ch.exe failed due to exception code c0000420

The assertion is triggered when the second time executing Object.prototype.toString.call(Array()). According to [http://www.ecma-international.org/ecma-262/#sec-object.prototype.tostring], toString should get @@toStringTag. https://github.com/microsoft/ChakraCore/blob/7d4bdd821d452d6b91a21936257d7e352ea7dc4b/lib/Runtime/Library/JavascriptObject.cpp#L444-L445 Since Array does not contain @@toStringTag, undefined is fetched for the first time, and the value is stored in inline cache. After calling func(arr), Array contains @@toStringTag, which is inherited by the Promise object. However, the value in inline cache is not invalid. When Object.prototype.toString.call(Array()) is executed again, the assertion is triggered and the old value undefined is fetched.

ISec Lab. 2020.12.16