Fix WritePoolGuard() using a byte offset.

Fixes basic/testCondSwitch1.js.