Bug 707051 - Change MarkChildren for shapes (r=igor)

js/src/jsapi.cpp

@@ -4183,7 +4183,7 @@ JS_NextProperty(JSContext *cx, JSObject *iterobj, jsid *idp)
             JS_ASSERT(shape->isEmptyShape());
             *idp = JSID_VOID;
         } else {
-            iterobj->setPrivate(const_cast<Shape *>(shape->previous()));
+            iterobj->setPrivate(const_cast<Shape *>(shape->previous().get()));
             *idp = shape->propid();
         }
     } else {

js/src/jsgcmark.cpp

@@ -735,6 +735,7 @@ restart:
     else if (JS_UNLIKELY(JSID_IS_OBJECT(id)))
         PushMarkStack(gcmarker, JSID_TO_OBJECT(id));
 
+    /* We need the loop here to prevent unbounded recursion. */
     shape = shape->previous();
     if (shape && shape->markIfUnmarked(gcmarker->getMarkColor()))
         goto restart;
@@ -974,13 +975,11 @@ MarkChildren(JSTracer *trc, JSScript *script)
 void
 MarkChildren(JSTracer *trc, const Shape *shape)
 {
-restart:
     MarkBaseShapeUnbarriered(trc, shape->base(), "base");
     MarkIdUnbarriered(trc, shape->maybePropid(), "propid");
 
-    shape = shape->previous();
-    if (shape)
-        goto restart;
+    if (shape->previous())
+        MarkShape(trc, shape->previous(), "parent");
 }
 
 void

js/src/jsscope.h

@@ -592,7 +592,7 @@ struct Shape : public js::gc::Cell
         return !(flags & NON_NATIVE);
     }
 
-    const js::Shape *previous() const {
+    const HeapPtrShape &previous() const {
         return parent;
     }