Bug 858900 - Poison JSContext. r=luke

js/public/Utility.h

@@ -508,6 +508,17 @@ js_delete(T *p)
     }
 }
 
+template<class T>
+static JS_ALWAYS_INLINE void
+js_delete_poison(T *p)
+{
+    if (p) {
+        p->~T();
+        memset(p, 0x3B, sizeof(T));
+        js_free(p);
+    }
+}
+
 template <class T>
 static JS_ALWAYS_INLINE T *
 js_pod_malloc()

js/src/jscntxt.cpp

@@ -431,7 +431,7 @@ js::DestroyContext(JSContext *cx, DestroyContextMode mode)
         JS::PrepareForFullGC(rt);
         GC(rt, GC_NORMAL, JS::gcreason::DESTROY_CONTEXT);
     }
-    js_delete(cx);
+    js_delete_poison(cx);
 }
 
 bool