[INFER] Spot fix for shapes not being marked when a child is held by AutoShapeRooter, bug 642209.

js/src/jsapi.cpp

@@ -4103,7 +4103,7 @@ prop_iter_trace(JSTracer *trc, JSObject *obj)
 
     if (obj->getSlot(JSSLOT_ITER_INDEX).toInt32() < 0) {
         /* Native case: just mark the next property to visit. */
-        ((Shape *) pdata)->trace(trc);
+        Shape::trace(trc, (Shape *) pdata);
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;

js/src/jsdbgapi.cpp

@@ -651,7 +651,7 @@ js_TraceWatchPoints(JSTracer *trc)
         if (wp->object->isMarked()) {
             if (!wp->shape->marked()) {
                 modified = true;
-                wp->shape->trace(trc);
+                Shape::trace(trc, wp->shape);
             }
             if (wp->shape->hasSetterValue() && wp->setter) {
                 if (!CastAsObject(wp->setter)->isMarked()) {

js/src/jsgc.cpp

@@ -1517,7 +1517,7 @@ AutoGCRooter::trace(JSTracer *trc)
         return;
 
       case SHAPE:
-        static_cast<AutoShapeRooter *>(this)->shape->trace(trc);
+        Shape::trace(trc, static_cast<AutoShapeRooter *>(this)->shape);
         return;
 
       case PARSER:

js/src/jsgcinlines.h

@@ -641,7 +641,7 @@ MarkShapeRange(JSTracer *trc, const Shape **beg, const Shape **end, const char *
 {
     for (const Shape **sp = beg; sp < end; ++sp) {
         JS_SET_TRACING_INDEX(trc, name, sp - beg);
-        (*sp)->trace(trc);
+        Shape::trace(trc, *sp);
     }
 }
 

js/src/jsinfer.cpp

@@ -4196,7 +4196,7 @@ types::TypeObject::trace(JSTracer *trc)
         int count = gc::FINALIZE_OBJECT_LAST - gc::FINALIZE_OBJECT0 + 1;
         for (int i = 0; i < count; i++) {
             if (emptyShapes[i])
-                emptyShapes[i]->trace(trc);
+                Shape::trace(trc, emptyShapes[i]);
         }
     }
 

js/src/jsscope.cpp

@@ -1423,26 +1423,28 @@ PrintPropertyMethod(JSTracer *trc, char *buf, size_t bufsize)
 #endif
 
 void
-Shape::trace(JSTracer *trc) const
+Shape::trace(JSTracer *trc, const Shape *shape)
 {
-    if (IS_GC_MARKING_TRACER(trc))
-        mark();
+    do {
+        if (IS_GC_MARKING_TRACER(trc))
+            shape->mark();
 
-    MarkId(trc, id, "id");
+        MarkId(trc, shape->id, "id");
 
-    if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
-        if ((attrs & JSPROP_GETTER) && rawGetter) {
-            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, this, 0);
-            Mark(trc, getterObject());
+        if (shape->attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
+            if ((shape->attrs & JSPROP_GETTER) && shape->rawGetter) {
+                JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, shape, 0);
+                Mark(trc, shape->getterObject());
+            }
+            if ((shape->attrs & JSPROP_SETTER) && shape->rawSetter) {
+                JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, shape, 1);
+                Mark(trc, shape->setterObject());
+            }
         }
-        if ((attrs & JSPROP_SETTER) && rawSetter) {
-            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, this, 1);
-            Mark(trc, setterObject());
-        }
-    }
 
-    if (isMethod()) {
-        JS_SET_TRACING_DETAILS(trc, PrintPropertyMethod, this, 0);
-        Mark(trc, &methodObject());
-    }
+        if (shape->isMethod()) {
+            JS_SET_TRACING_DETAILS(trc, PrintPropertyMethod, shape, 0);
+            Mark(trc, &shape->methodObject());
+        }
+    } while ((shape = shape->parent) != NULL && !shape->marked());
 }

js/src/jsscope.h

@@ -592,7 +592,7 @@ struct Shape : public JSObjectMap
 
     inline bool isSharedPermanent() const;
 
-    void trace(JSTracer *trc) const;
+    static void trace(JSTracer *trc, const Shape *shape);
 
     bool hasSlot() const { return (attrs & JSPROP_SHARED) == 0; }
 

js/src/jsscopeinlines.h

@@ -159,9 +159,7 @@ JSObject::trace(JSTracer *trc)
     }
 
     /* Trace our property tree or dictionary ancestor line. */
-    do {
-        shape->trace(trc);
-    } while ((shape = shape->parent) != NULL && !shape->marked());
+    js::Shape::trace(trc, shape);
 }
 
 namespace js {

js/src/jsscript.cpp

@@ -294,7 +294,7 @@ void
 Bindings::trace(JSTracer *trc)
 {
     for (const Shape *shape = lastBinding; shape; shape = shape->previous())
-        shape->trace(trc);
+        Shape::trace(trc, shape);
 }
 
 } /* namespace js */