Bug 839673 - Do not access the ArenaHeader of already-finalized GCThings; r=luke

js/src/jsweakmap.cpp

@@ -373,6 +373,11 @@ WeakMap_finalize(FreeOp *fop, RawObject obj)
 {
     if (ObjectValueMap *map = GetObjectMap(obj)) {
         map->check();
+        /*
+         * The map may contain finalized entries, so drop them before destructing to avoid calling
+         * ~EncapsulatedPtr.
+         */
+        map->clearWithoutCallingDestructors();
 #ifdef DEBUG
         map->~ObjectValueMap();
         memset(static_cast<void *>(map), 0xdc, sizeof(*map));