From 22153855e2c8c86ba9dffb0f45b18f4cc07cc2a1 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Mon, 11 Jul 2016 09:46:45 -0700
Subject: [PATCH] Bug 1280591 - Assert if we try to add a poisoned root;
 r=sfink

---
 js/src/gc/RootMarking.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index 102098016ad0..af031d2b95a5 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -392,7 +392,6 @@ js::gc::GCRuntime::bufferGrayRoots()
     for (GCZonesIter zone(rt); !zone.done(); zone.next())
         MOZ_ASSERT(zone->gcGrayRoots.empty());
 
-
     BufferGrayRootsTracer grayBufferer(rt);
     if (JSTraceDataOp op = grayRootTracer.op)
         (*op)(&grayBufferer, grayRootTracer.data);
@@ -414,6 +413,8 @@ void
 BufferGrayRootsTracer::onChild(const JS::GCCellPtr& thing)
 {
     MOZ_ASSERT(runtime()->isHeapBusy());
+    MOZ_RELEASE_ASSERT(thing);
+    MOZ_RELEASE_ASSERT((uintptr_t(thing.asCell()) & 0xFFFFFF00) != 0xE5E5E500);
 
     if (bufferingGrayRootsFailed)
         return;