import changes from `dev' branch of rmottola/Arctic-Fox:

- Bug 1154950 - Share permanent atom and well-known symbol marking; r=sfink (1a2f43d38)
- Bug 1156632 - Remove unused forward class declarations - patch 7 - JS, r=sfink (80d86b771)
- Bug 1157628: Reformat spidermonkey source directory, again; r=jandem (d319a1e4e)
- fix typo applying Bug 1147180 (5b62ca909)
- Bug 1156390 - Do CheckMarkedThing on internal edges as well as roots; r=sfink (382778860)
- Bug 1157533 - Share Value and jsid typed dispatch code; r=jonco (43f1115f1)
- Bug 1157829 - The markAndScan functions are now just an additional assertion; r=sfink (1b16dcb0f)
- Bug 1156533 - Simplify how we trace Shapes for marking; r=sfink (50861816c)
- Bug 1156552 - Move BaseShape marking out-of-line; r=sfink (0a843db77)
- Bug 1156888 - Do not go out-of-line to eagerly scan LazyScript instances; r=sfink (871555c46)
- Bug 1157828 - Move ShouldMarkCrossCompartment adjacent to other marking invariant logic; r=jonco (78afe9dc7)
- pointer style (d0acfa0f7)
- Bug 1155033 - Handle cyclic or deep ObjectGroup tracing chains during cycle collection, r=terrence. (9c2df72c6)
- Bug 1158313 - Move Symbol marking out-of-line; r=jonco (02f5bc494)
- Bug 1158353 - Clean up eager string marking; r=jonco (55c49952f)
- Bug 1158354 - Clean up ObjectGroup marking; r=sfink (372e90498)
- pointer style (ce9ee4a12)
- Bug 1158357 - Inline processMarkStackOther to make the dispatch obvious; r=jonco (024202539)
- Bug 1159465 - Automatically check for cross-compartment edges between objects when marking; r=jonco (f6e01f005)
- pointer style (1de5dbac3)
- add missing bit of Bug 1147180 (2952a13ae)
- missing bit of Bug 1117753 (0998c336a)
- pointer style (1d6d60c63)
- Bug 1159540 - Organize and comment the marking paths; r=sfink (e4a9ded85)
- Bug 1159402 - Remove the zone-specialized Value barriers; r=sfink (881aaf77c)

xpcom/base/CycleCollectedJSRuntime.cpp

@@ -394,9 +394,8 @@ NoteJSChild(JS::CallbackTracer* aTrc, JS::GCCellPtr aThing)
    * This function needs to be careful to avoid stack overflow. Normally, when
    * AddToCCKind is true, the recursion terminates immediately as we just add
    * |thing| to the CC graph. So overflow is only possible when there are long
-   * chains of non-AddToCCKind GC things. Currently, this only can happen via
-   * shape parent pointers. The special JSTRACE_SHAPE case below handles
-   * parent pointers iteratively, rather than recursively, to avoid overflow.
+   * or cyclic chains of non-AddToCCKind GC things. Places where this can occur
+   * use special APIs to handle such chains iteratively.
    */
   if (AddToCCKind(aThing.kind())) {
     if (MOZ_UNLIKELY(tracer->mCb.WantDebugInfo())) {
@@ -410,7 +409,14 @@ NoteJSChild(JS::CallbackTracer* aTrc, JS::GCCellPtr aThing)
       tracer->mCb.NoteJSScript(aThing.toScript());
     }
   } else if (aThing.isShape()) {
+    // The maximum depth of traversal when tracing a Shape is unbounded, due to
+    // the parent pointers on the shape.
     JS_TraceShapeCycleCollectorChildren(aTrc, aThing);
+  } else if (aThing.isObjectGroup()) {
+    // The maximum depth of traversal when tracing an ObjectGroup is unbounded,
+    // due to information attached to the groups which can lead other groups to
+    // be traced.
+    JS_TraceObjectGroupCycleCollectorChildren(aTrc, aThing);
   } else if (!aThing.isString()) {
     JS_TraceChildren(aTrc, aThing.asCell(), aThing.kind());
   }