Backed out 7 changesets (bug 1147588, bug 1147669, bug 1147533, bug 1147665, bug 1135985, bug 1147180, bug 1147670) for frequent 10.10 devtools-2 GC assertion failures

CLOSED TREE

Backed out changeset 0bd8c4ec41fa (bug 1147670)
Backed out changeset 35ad82ff9ee7 (bug 1147669)
Backed out changeset ffe7f2e2a0f0 (bug 1147665)
Backed out changeset 37c42cff2c01 (bug 1147588)
Backed out changeset be4138f208ba (bug 1147533)
Backed out changeset 6bbd529bd995 (bug 1147180)
Backed out changeset 853e3ad56dad (bug 1135985)

js/src/jsobj.cpp

@@ -4090,10 +4090,10 @@ JSObject::markChildren(JSTracer *trc)
                 }
             }
 
-            TraceRange(trc,
-                       nobj->getDenseInitializedLength(),
-                       static_cast<HeapSlot*>(nobj->getDenseElementsAllowCopyOnWrite()),
-                       "objectElements");
+            gc::MarkArraySlots(trc,
+                               nobj->getDenseInitializedLength(),
+                               nobj->getDenseElementsAllowCopyOnWrite(),
+                               "objectElements");
         } while (false);
     }
 }