Bug 931218 - Fix an exact rooting hazard in JS_StealArrayBufferContents; r=sfink