Bug 916752 - IonMonkey: TypeBarrier will be typed when always bails, r=jandem