The basic assumption of poisoning is that any future use of the poisoned value will lead to an immediate crash when we dereference an invalid pointer. Unfortunately, insertion or removal of a pointer into a HashTable is one place where that is not true. Thankfully, PointerHasher gives us a location that we can intercept.

We still hit an error in testObjectEmulatingUndefined_equal with this, but it fails with a non-NULL assertion instead of total insanity. This may also introduce some new jit-test failures: the first one I checked was not from this so I thought I would work through those separately.

Green try run at: https://tbpl.mozilla.org/?tree=Try&rev=10884c1544c4 Pushed at: https://hg.mozilla.org/integration/mozilla-inbound/rev/aad582ab4aee