Fix for bug 492324 ("ASSERTION: wrong entry" during cycle collection (nsXBLDocumentInfo)). r=dbaron, sr=jst.

--HG--
extra : rebase_source : ea5eb556d1fe86b42ede4a0515e0c4c06544117b

xpcom/base/nsCycleCollector.cpp

@@ -644,6 +644,9 @@ static void
 WriteGraph(FILE *stream, GCGraph &graph, const void *redPtr);
 #endif
 
+static inline void
+ToParticipant(nsISupports *s, nsXPCOMCycleCollectionParticipant **cp);
+
 struct nsPurpleBuffer
 {
 private:
@@ -717,8 +720,12 @@ public:
 
     void FreeBlocks()
     {
+        if (mCount > 0)
+            UnmarkRemainingPurple(&mFirstBlock);
         Block *b = mFirstBlock.mNext; 
         while (b) {
+            if (mCount > 0)
+                UnmarkRemainingPurple(b);
             Block *next = b->mNext;
             delete b;
             b = next;
@@ -726,6 +733,25 @@ public:
         mFirstBlock.mNext = nsnull;
     }
 
+    void UnmarkRemainingPurple(Block *b)
+    {
+        for (nsPurpleBufferEntry *e = b->mEntries,
+                              *eEnd = e + NS_ARRAY_LENGTH(b->mEntries);
+             e != eEnd; ++e) {
+            if (!(PRUword(e->mObject) & PRUword(1))) {
+                // This is a real entry (rather than something on the
+                // free list).
+                nsXPCOMCycleCollectionParticipant *cp;
+                ToParticipant(e->mObject, &cp);
+
+                cp->UnmarkPurple(e->mObject);
+
+                if (--mCount == 0)
+                    break;
+            }
+        }
+    }
+
     void SelectPointers(GCGraphBuilder &builder);
 
 #ifdef DEBUG_CC