Bug 341877: Reverting the previous commit, the patch was broken.

js/src/jscntxt.h

@@ -649,9 +649,6 @@ struct JSContext {
     /* Top of the GC mark stack. */
     void                *gcCurrentMarkNode;
 #endif
-
-    /* List of native iterator states, needed for marking id arrays. */
-    JSNativeIteratorState *nativeIteratorStates;
 };
 
 #define JS_THREAD_ID(cx)            ((cx)->thread ? (cx)->thread->id : 0)

js/src/jsgc.c

@@ -2449,9 +2449,6 @@ restart:
         if (acx->sharpObjectMap.depth > 0)
             js_GCMarkSharpMap(cx, &acx->sharpObjectMap);
 
-        if (acx->nativeIteratorStates)
-            js_MarkNativeIteratorStates(cx, acx->nativeIteratorStates);
-
         acx->cachedIterObj = NULL;
     }
 

js/src/jsiter.c

@@ -76,6 +76,33 @@ extern const char js_throw_str[]; /* from jsscan.h */
 #error JS_INITIAL_NSLOTS must be greater than JSSLOT_ITER_FLAGS.
 #endif
 
+static uint32
+iterator_mark(JSContext *cx, JSObject *obj, void *arg)
+{
+    jsval state, parent;
+    JSObject *iterable;
+
+    /* Avoid double work if js_CloseNativeIterator was called on obj. */
+    state = obj->slots[JSSLOT_ITER_STATE];
+    if (JSVAL_IS_VOID(state))
+        return 0;
+
+    parent = obj->slots[JSSLOT_PARENT];
+    if (!JSVAL_IS_NULL(state) && !JSVAL_IS_PRIMITIVE(parent)) {
+        iterable = JSVAL_TO_OBJECT(parent);
+#if JS_HAS_XML_SUPPORT
+        if ((JSVAL_TO_INT(obj->slots[JSSLOT_ITER_FLAGS]) & JSITER_FOREACH) &&
+            OBJECT_IS_XML(cx, iterable)) {
+            ((JSXMLObjectOps *) iterable->map->ops)->
+                enumerateValues(cx, iterable, JSENUMERATE_MARK, &state,
+                                NULL, NULL);
+        } else
+#endif
+            OBJ_ENUMERATE(cx, iterable, JSENUMERATE_MARK, &state, NULL);
+    }
+    return 0;
+}
+
 static void
 iterator_close(JSContext *cx, JSObject *obj)
 {
@@ -110,7 +137,8 @@ JSExtendedClass js_IteratorClass = {
     JSCLASS_HAS_CACHED_PROTO(JSProto_Iterator),
     JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,  JS_PropertyStub,
     JS_EnumerateStub, JS_ResolveStub,   JS_ConvertStub,   JS_FinalizeStub,
-    JSCLASS_NO_OPTIONAL_MEMBERS },
+    NULL,             NULL,             NULL,             NULL,
+    NULL,             NULL,             iterator_mark,    NULL },
     NULL,             NULL,             NULL,             iterator_close,
     JSCLASS_NO_RESERVED_MEMBERS
 };

js/src/jsobj.c

@@ -3673,12 +3673,10 @@ js_SetIdArrayLength(JSContext *cx, JSIdArray *ida, jsint length)
 }
 
 /* Private type used to iterate over all properties of a native JS object */
-struct JSNativeIteratorState {
-    jsint                   next_index; /* index into jsid array */
-    JSIdArray               *ida;       /* all property ids in enumeration */
-    JSNativeIteratorState   *next;      /* double-linked list support */
-    JSNativeIteratorState   **prevp;
-};
+typedef struct JSNativeIteratorState {
+    jsint next_index;   /* index into jsid array */
+    JSIdArray *ida;     /* all property ids in enumeration */
+} JSNativeIteratorState;
 
 /*
  * This function is used to enumerate the properties of native JSObjects
@@ -3774,13 +3772,6 @@ js_Enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
         }
         state->ida = ida;
         state->next_index = 0;
-
-        state->next = cx->nativeIteratorStates;
-        if (state->next)
-            state->next->prevp = &state->next;
-        state->prevp = &cx->nativeIteratorStates;
-        *state->prevp = state;
-
         *statep = PRIVATE_TO_JSVAL(state);
         if (idp)
             *idp = INT_TO_JSVAL(length);
@@ -3798,43 +3789,28 @@ js_Enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
 
       case JSENUMERATE_DESTROY:
         state = (JSNativeIteratorState *) JSVAL_TO_PRIVATE(*statep);
-
-        JS_ASSERT(cx->nativeIteratorStates);
-        JS_ASSERT(*state->prevp == state);
-        if (state->next) {
-            JS_ASSERT(state->next->prevp == &state->next);
-            state->next->prevp = state->prevp;
-        }
-        *state->prevp = state->next;
-
         JS_DestroyIdArray(cx, state->ida);
         JS_free(cx, state);
         *statep = JSVAL_NULL;
         break;
-    }
-    return JS_TRUE;
-}
 
-void
-js_MarkNativeIteratorStates(JSContext *cx, JSNativeIteratorState *state)
-{
-    jsid *cursor, *end, id;
+      case JSENUMERATE_MARK:
+        state = (JSNativeIteratorState *) JSVAL_TO_PRIVATE(*statep);
+        ida = state->ida;
+        length = ida->length;
+        for (i = 0; i < length; i++) {
+            jsid id;
 
-    JS_ASSERT(state);
-
-    do {
-        JS_ASSERT(*state->prevp == state);
-        cursor = state->ida->vector;
-        end = cursor + state->ida->length;
-        for (; cursor != end; ++cursor) {
-            id = *cursor;
+            id = ida->vector[i];
             if (JSID_IS_ATOM(id)) {
                 GC_MARK_ATOM(cx, JSID_TO_ATOM(id));
             } else if (JSID_IS_OBJECT(id)) {
                 GC_MARK(cx, JSID_TO_OBJECT(id), "ida->vector[i]");
             }
         }
-    } while ((state = state->next) != NULL);
+        break;
+    }
+    return JS_TRUE;
 }
 
 JSBool

js/src/jsobj.h

@@ -498,14 +498,6 @@ extern JSBool
 js_Enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
              jsval *statep, jsid *idp);
 
-/*
- * js_Enumerate uses this opaque structure to hold its state.
- */
-typedef struct JSNativeIteratorState JSNativeIteratorState;
-
-extern void
-js_MarkNativeIteratorStates(JSContext *cx, JSNativeIteratorState *state);
-
 extern JSBool
 js_CheckAccess(JSContext *cx, JSObject *obj, jsid id, JSAccessMode mode,
                jsval *vp, uintN *attrsp);

js/src/jspubtd.h

@@ -119,7 +119,8 @@ typedef enum JSAccessMode {
 typedef enum JSIterateOp {
     JSENUMERATE_INIT,       /* Create new iterator state */
     JSENUMERATE_NEXT,       /* Iterate once */
-    JSENUMERATE_DESTROY     /* Destroy iterator state */
+    JSENUMERATE_DESTROY,    /* Destroy iterator state */
+    JSENUMERATE_MARK        /* mark opaque iterator state */
 } JSIterateOp;
 
 /* Struct typedefs. */

js/src/jsxml.c

@@ -5151,6 +5151,9 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
         }
         *statep = JSVAL_NULL;
         break;
+
+      case JSENUMERATE_MARK:
+        break;
     }
     return JS_TRUE;
 }
@@ -5310,6 +5313,9 @@ xml_enumerateValues(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
         }
         *statep = JSVAL_NULL;
         break;
+
+      case JSENUMERATE_MARK:
+        break;
     }
     return JS_TRUE;
 }