Core dumped ASSERTION 1543856: (ChakraCore/lib/Runtime/Language/JavascriptConversion.cpp, line 1251) bad type object in conversion ToUInt32

[anbu1024]

ChakraCore version:
commit c3ead3f

Build cmd:

./build.sh --debug --static

Test case:

function foo(){
  async function bar(arg) {
      const a = 5.0 == 5.0;
      const b = await arg;
      (1780181346).valueOf >>>= 0;
      const c = 1.0 > 1.0;
  }
  
  const ret = bar();
  return ret;
}

for(let i=0;i<0x300;i++){
	foo();
}

Error msg:

ASSERTION 1543856: (ChakraCore/lib/Runtime/Language/JavascriptConversion.cpp, line 1251) bad type object in conversion ToUInt32
 Failure: (JavascriptOperators::IsObject(aValue))
Illegal instruction (core dumped)