Bug 655297 - Mark XPC wrapped natives used as weak map keys. r=billm

js/src/jsweakmap.h

@@ -235,6 +235,11 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
 };
 
 // Marking policy for maps from JSObject pointers to js::Values.
+//
+// We always mark wrapped natives.  This will cause leaks, but WeakMap+CC
+// integration is currently busted anyways.  When WeakMap+CC integration is
+// fixed in Bug 668855, XPC wrapped natives should only be marked during
+// non-BLACK marking (ie grey marking).
 template <>
 class DefaultMarkPolicy<JSObject *, Value> {
   private:
@@ -247,12 +252,32 @@ class DefaultMarkPolicy<JSObject *, Value> {
             return !IsAboutToBeFinalized(tracer->context, v.toGCThing());
         return true;
     }
+  private:
+    bool markUnmarkedValue(const Value &v) {
+        if (valueMarked(v))
+            return false;
+        js::gc::MarkValue(tracer, v, "WeakMap entry value");
+        return true;
+    }
+
+    // Return true if we should override the GC's default marking
+    // behavior for this key.
+    bool overrideKeyMarking(JSObject *k) {
+        // We only need to worry about extra marking of keys when
+        // we're doing a GC marking pass.
+        if (!IS_GC_MARKING_TRACER(tracer))
+            return false;
+        return k->getClass()->ext.isWrappedNative;
+    }
+  public:
     bool markEntryIfLive(JSObject *k, const Value &v) {
-        if (keyMarked(k) && !valueMarked(v)) {
-            js::gc::MarkValue(tracer, v, "WeakMap entry value");
-            return true;
-        }
-        return false;
+        if (keyMarked(k))
+            return markUnmarkedValue(v);
+        if (!overrideKeyMarking(k))
+            return false;
+        js::gc::MarkObject(tracer, *k, "WeakMap entry wrapper key");
+        markUnmarkedValue(v);
+        return true;
     }
     void markEntry(JSObject *k, const Value &v) {
         js::gc::MarkObject(tracer, *k, "WeakMap entry key");