Bug 1280591 - Assert if we try to add a poisoned root; r=sfink

js/src/gc/RootMarking.cpp

@@ -392,7 +392,6 @@ js::gc::GCRuntime::bufferGrayRoots()
     for (GCZonesIter zone(rt); !zone.done(); zone.next())
         MOZ_ASSERT(zone->gcGrayRoots.empty());
 
-
     BufferGrayRootsTracer grayBufferer(rt);
     if (JSTraceDataOp op = grayRootTracer.op)
         (*op)(&grayBufferer, grayRootTracer.data);
@@ -414,6 +413,8 @@ void
 BufferGrayRootsTracer::onChild(const JS::GCCellPtr& thing)
 {
     MOZ_ASSERT(runtime()->isHeapBusy());
+    MOZ_RELEASE_ASSERT(thing);
+    MOZ_RELEASE_ASSERT((uintptr_t(thing.asCell()) & 0xFFFFFF00) != 0xE5E5E500);
 
     if (bufferingGrayRootsFailed)
         return;