[MERGE #5227 @sethbrenith] quiet a spurious assertion
[MERGE #5227 @sethbrenith] quiet a spurious assertion

Merge pull request #5227 from sethbrenith:user/sethb/substring-assert

I recently added an assertion to make sure that the owning reference for SubStrings points to something reasonable. I missed a case, which happens in the following minimum repro:

```javascript
("" + [undefined, undefined]).trim()
```

Array.prototype.toString generates a CompoundString with only one character. GetSz on the CompoundString has a special case for single-character strings, where it points to the same buffer as the copy of that string in the script context's cache. Then `trim` tries to make a substring, but asserts that we've done something wrong. The assertion is wrong (this operation is safe) because the buffer is held alive by the collection of single-character strings.

(`trim` could easily avoid allocating a new SubString in this case, but that's beyond the scope of this change.)

Fixes OS:17642622

Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore