Bug 992866 - Fix assertion in JSObject::initDenseElementsUnbarriered r=sfink