Bug 926778 - Prevent executable allocator from handing out poisoned pointers with JSGC_ROOT_ANALYSIS, r=terrence