Bug 1041688 - Allow jitcode to overwrite barriered TypeObject pointers, r=jandem.