fixup backout of bug 902316 on a CLOSED TREE
Back out 6a5a7b55c22a:9f324fcd43ec (bug 903394) for js::types::StackTypeSet::propertyNeedsBarrier crashes
CLOSED TREE