XMLHttpRequest isn't rooted while in flight

osx-test/hello-osx.js has this block:

            this.xmlhttp = new XMLHttpRequest();
            this.xmlhttp.onreadystatechange = () => {
        console.log ("readyState == " + this.xmlhttp.readyState);
        if (this.xmlhttp.readyState === 4) {
                    console.log ("woohoo!");
            console.log (this.xmlhttp.responseText);
        }
            };
        console.log (this.xmlhttp.onreadystatechange);
            this.xmlhttp.open('GET', 'http://www.google.com/', true);
            this.xmlhttp.send();

'xmlhttp' should be a local variable, but if you make it one we crash, since the .send() doesn't cause it to be rooted by the GC. The GC frees it and we crash when attempting to call the onreadystatechange callback.

Start with the XMLHttpRequest example in osx-test/hello-osx.js and trace what happens from send() through the asynchronous onreadystatechange callback. Investigate how the runtime roots objects during an in-flight request. Done means the local XMLHttpRequest remains alive until the callback runs and the example no longer crashes after garbage collection.