Assertion Failure at HandleRootOwner.h:413

## Bug Description

When running `hermes $JSFILE` with some crafted JSFILEs, `hermes` may trigger the assertion failure.

- [x] I have confirmed this bug does not occur with JSC

Hermes version: 0.7.0 (git ab7c2cfa)
React Native version (if any):
Android version (if any):
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): x86_64

## Steps To Reproduce

1. Craft a javascript file `test.js` with the following content:
```javascript
h = {}
p = new Proxy({}, h)
h.__proto__ = p;
try { p._ } catch {}
```

2. run `./hermes test.js` and it reports:

```
hermes: /home/hongxu/work/hermes/hermes-asan/include/hermes/VM/HandleRootOwner.h:413: hermes::vm::PinnedHermesValue* hermes::vm::GCScope::newHandle(hermes::vm::HermesValue): Assertion `getHandleCountDbg() < handlesLimit_ && "Too many handles allocated in GCScope"' failed.
```

## The Expected Behavior
No assertion triggered.