Bug 885539 - Crash - Heap-use-after-free in nsTArray_base. r=bz, a=bajaj