Bug 798678 - WeakMaps with keys from another compartment are possible and incorrect (tests) (r=mccr8)

js/src/gc/Heap.h

@@ -972,7 +972,7 @@ AssertValidColor(const void *thing, uint32_t color)
 {
 #ifdef DEBUG
     ArenaHeader *aheader = reinterpret_cast<const Cell *>(thing)->arenaHeader();
-    JS_ASSERT_IF(color, color < aheader->getThingSize() / CellSize);
+    JS_ASSERT(color < aheader->getThingSize() / CellSize);
 #endif
 }
 
@@ -1015,6 +1015,7 @@ bool
 Cell::isMarked(uint32_t color /* = BLACK */) const
 {
     JS_ASSERT(isTenured());
+    JS_ASSERT(arenaHeader()->allocated());
     AssertValidColor(this, color);
     return chunk()->bitmap.isMarked(this, color);
 }

js/src/jit-test/tests/basic/bug798678.js

@@ -0,0 +1,10 @@
+var w = new WeakMap();
+var g = newGlobal();
+var k = g.eval('for (var i=0; i<100; i++) new Object(); var q = new Object(); q');
+w.set(k, {});
+k = null;
+
+gc();
+g.eval('q = null');
+gc(g);
+gc();