Pass the raw typed array element by reference when converting it to a Value. Followup to bug 749933 noted by Ms2ger, r=lumpy

--HG--
extra : rebase_source : 74d838c57ce3448d588d94e5d63f298a06d850a2

js/src/vm/ObjectImpl.cpp

@@ -322,14 +322,14 @@ SparseElementsHeader::getOwnElement(JSContext *cx, ObjectImpl *obj, uint32_t ind
 
 template<typename T>
 static Value
-ElementToValue(const T t)
+ElementToValue(const T &t)
 {
     return NumberValue(t);
 }
 
 template<>
 /* static */ Value
-ElementToValue(const uint8_clamped u)
+ElementToValue(const uint8_clamped &u)
 {
     return NumberValue(uint8_t(u));
 }