Back out e0cb9fb30750 (bug 707051) for test failures

js/src/jsapi.cpp

@@ -4183,7 +4183,7 @@ JS_NextProperty(JSContext *cx, JSObject *iterobj, jsid *idp)
             JS_ASSERT(shape->isEmptyShape());
             *idp = JSID_VOID;
         } else {
-            iterobj->setPrivate(const_cast<Shape *>(shape->previous().get()));
+            iterobj->setPrivate(const_cast<Shape *>(shape->previous()));
             *idp = shape->propid();
         }
     } else {

js/src/jsgcmark.cpp

@@ -735,7 +735,6 @@ restart:
     else if (JS_UNLIKELY(JSID_IS_OBJECT(id)))
         PushMarkStack(gcmarker, JSID_TO_OBJECT(id));
 
-    /* We need the loop here to prevent unbounded recursion. */
     shape = shape->previous();
     if (shape && shape->markIfUnmarked(gcmarker->getMarkColor()))
         goto restart;
@@ -975,11 +974,13 @@ MarkChildren(JSTracer *trc, JSScript *script)
 void
 MarkChildren(JSTracer *trc, const Shape *shape)
 {
+restart:
     MarkBaseShapeUnbarriered(trc, shape->base(), "base");
     MarkIdUnbarriered(trc, shape->maybePropid(), "propid");
 
-    if (shape->previous())
-        MarkShape(trc, shape->previous(), "parent");
+    shape = shape->previous();
+    if (shape)
+        goto restart;
 }
 
 void

js/src/jsscope.h

@@ -592,7 +592,7 @@ struct Shape : public js::gc::Cell
         return !(flags & NON_NATIVE);
     }
 
-    const HeapPtrShape &previous() const {
+    const js::Shape *previous() const {
         return parent;
     }