Bug 957542 - Don't over-allocate dynamic slots of ArrayObject, r=bhackett