Bug 949940.  Only enter the uncheckedObj compartment in a crossOriginGetter/Setter/Method around the UnwrapArg call that needs us to be in that compartment.  r=peterv
Bug 950991.  Root on-stack JSObject* and JS::Value return values.  r=smaug