Fix assertion in KnownCellUse inside SpeculativeJIT::speculate