Back out 6a5a7b55c22a:9f324fcd43ec (bug 903394) for js::types::StackTypeSet::propertyNeedsBarrier crashes
CLOSED TREE