--- a/xpcom/base/CycleCollectedJSRuntime.cpp
+++ b/xpcom/base/CycleCollectedJSRuntime.cpp
@@ -1055,16 +1055,28 @@ CycleCollectedJSRuntime::DeferredFinaliz
   if (!hadThingArray) {
     mDeferredFinalizerTable.Put(aFunc, thingArray);
   }
 }
 
 void
 CycleCollectedJSRuntime::DeferredFinalize(nsISupports* aSupports)
 {
+#if defined(XP_MACOSX) && defined(__LP64__)
+  // We'll crash here if aSupports is poisoned (== 0x5a5a5a5a5a5a5a5a).  This
+  // is better (more informative) than crashing in ReleaseSliceNow().  See
+  // bug 997908.  This patch should get backed out when bug 997908 gets fixed,
+  // or if it doesn't actually help diagnose that bug.
+  __asm__ __volatile__("push %%rax;"
+                       "push %%rdx;"
+                       "movq %0, %%rax;"
+                       "movq (%%rax), %%rdx;"
+                       "pop %%rdx;"
+                       "pop %%rax;" : : "g" (aSupports));
+#endif
   mDeferredSupports.AppendElement(aSupports);
 }
 
 void
 CycleCollectedJSRuntime::DumpJSHeap(FILE* aFile)
 {
   js::DumpHeapComplete(Runtime(), aFile, js::CollectNurseryBeforeDump);
 }