The data of an ArrayBuffer lives at backing_store(), not at
allocation_base(), which is just used as the pointer to free when the
buffer is unreachable.

Change-Id: Id6157ec4cf5b42631461327b3e6078fe25d20c57
Reviewed-on: https://chromium-review.googlesource.com/1143189Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54551}