Bug 641910. Don't add non-grey nodes to the cycle collector model graph. r=gal@uci.edu

js/src/xpconnect/src/nsXPConnect.cpp

@@ -727,7 +727,8 @@ nsXPConnect::Traverse(void *p, nsCycleCollectionTraversalCallback &cb)
 #endif
     {
         // Normal codepath (matches non-DEBUG_CC codepath).
-        type = !markJSObject && xpc_IsGrayGCThing(p) ? GCUnmarked : GCMarked;
+        NS_ASSERTION(xpc_IsGrayGCThing(p), "Tried to traverse a non-gray object.");
+        type = markJSObject ? GCMarked : GCUnmarked;
     }
 
     if (cb.WantDebugInfo()) {

xpcom/base/nsCycleCollector.cpp

@@ -150,6 +150,7 @@
 #include "nsICycleCollectorListener.h"
 #include "nsIXPConnect.h"
 #include "nsIJSRuntimeService.h"
+#include "xpcpublic.h"
 
 #include <stdio.h>
 #include <string.h>
@@ -1672,6 +1673,13 @@ GCGraphBuilder::NoteScriptChild(PRUint32 langID, void *child)
         return;
     }
 
+    // skip over non-grey JS children
+    if (langID == nsIProgrammingLanguage::JAVASCRIPT) {
+        JSObject *obj = static_cast<JSObject*>(child);
+        if (!xpc_IsGrayGCThing(obj) && !WantAllTraces())
+            return;
+    }
+
     nsCycleCollectionParticipant *cp = mRuntimes[langID]->ToParticipant(child);
     if (!cp)
         return;