joyent/node — pull request #6213 by indutny (2013-09-12 14:30:39+00:00)
Title: contextify: dealloc only after global and sandbox

Functions created using: `vm.runInNewContext('(function() { })')` will
reference only `proxy_global_` object and not `sandbox_`. Thus in case,
where there're no references to sandbox (such as in example above),
`ContextifyContext` will be destroyed and use-after-free might happen.

/cc @bnoordhuis @domenic