b=873757; crash in JSStructuredCloneWriter::writeArrayBuffer; r=bz