Left trimming assumes that nobody other than the JSArray has a reference to the
backing store. Sampling heap profiler may profile the backing store and keep a
reference too it. This reference was never updated on a left-trim, causing a
crash.

R=alph@chromium.org, hpayer@chromium.org, mattloring@google.com
BUG=

Review URL: https://codereview.chromium.org/1885723002

Cr-Commit-Position: refs/heads/master@{#35449}