Bug 1007298: IonMonkey: Remove bogus assertion in pushDOMTypeBarrier, r=bz