Bug 1476845 - Update IsThingPoisoned r=jonco

Not all the listed poison values were used in IsThingPoisoned

Differential Revision: https://phabricator.services.mozilla.com/D33449

--HG--
extra : moz-landing-system : lando

js/src/gc/Marking.cpp

@@ -130,8 +130,8 @@ static inline bool IsThingPoisoned(T* thing) {
       JS_ALLOCATED_NURSERY_PATTERN, JS_FRESH_TENURED_PATTERN,
       JS_MOVED_TENURED_PATTERN,     JS_SWEPT_TENURED_PATTERN,
       JS_ALLOCATED_TENURED_PATTERN, JS_FREED_HEAP_PTR_PATTERN,
-      JS_SWEPT_TI_PATTERN,          JS_SWEPT_CODE_PATTERN,
-      JS_FREED_CHUNK_PATTERN};
+      JS_FREED_CHUNK_PATTERN,       JS_FREED_ARENA_PATTERN,
+      JS_SWEPT_TI_PATTERN,          JS_SWEPT_CODE_PATTERN};
   const int numPoisonBytes = sizeof(poisonBytes) / sizeof(poisonBytes[0]);
   uint32_t* p =
       reinterpret_cast<uint32_t*>(reinterpret_cast<FreeSpan*>(thing) + 1);