Bug 907333 - IonMonkey: Add MAssertRange. r=h4writer