Bug 1029549 - Sanity-check TenuredHeap pointers when accessing them; r=jonco

--HG--
extra : rebase_source : 3aeb0679d121e301b1b6c5aea2511dbc1a419e55

js/public/RootingAPI.h

@@ -369,7 +369,11 @@ class TenuredHeap : public js::HeapBase<T>
         return (bits & flag) != 0;
     }
 
-    T getPtr() const { return reinterpret_cast<T>(bits & ~flagsMask); }
+    T getPtr() const {
+        T ptr = reinterpret_cast<T>(bits & ~flagsMask);
+        MOZ_ASSERT(JS::GetTenuredGCThingZone(ptr) != nullptr);
+        return ptr;
+    }
     uintptr_t getFlags() const { return bits & flagsMask; }
 
     operator T() const { return getPtr(); }