Bug 1123002 - Convert XPCStringConvert::ZoneStringCache::mBuffer to void*; r=mccr8

This variable is only used for pointer comparison in order to compute
a cache match.  This patch converts the type of the variable to void*
so that it can still be used for the pointer comparison, but not for
any other purpose, including dereferencing, since the pointer may
potentially be dangling if the string buffer dies.

js/xpconnect/src/xpcpublic.h

@@ -206,7 +206,11 @@ class XPCStringConvert
     // would take a lot more machinery.
     struct ZoneStringCache
     {
-        nsStringBuffer* mBuffer;
+        // mString owns mBuffer.  mString is a JS thing, so it can only die
+        // during GC.  We clear mString and mBuffer during GC.  As long as
+        // the above holds, mBuffer should not be a dangling pointer, so
+        // using this as a cache key should be safe.
+        void* mBuffer;
         JSString* mString;
     };