Assertion failure in PathTypeHandler.cpp

the following poc cause a assertion failure in "debug" build on ubuntu.

```
function v0(v1,v2) {
}
function v3(v4,v5) {
}
const v8 = [65537,v3,-2609076265,-2609076265];
const v9 = v0.bind();
v9.__proto__ = v8;
const v10 = delete v9.length;
v9[-1956872956] >>>= 65537;
with (v9) {
length = v10;
}
```