--- a/memory_profiler.cpp	Thu Jun 25 00:21:19 2009 -0700
+++ b/memory_profiler.cpp	Thu Jun 25 09:47:18 2009 -0700
@@ -219,16 +219,25 @@
 
 static intN rootMapFun(void *rp, const char *name, void *data)
 {
-  jsval **val = (jsval **) rp;
-  if (JSVAL_IS_OBJECT(**val)) {
-    RootMapStruct *roots = (RootMapStruct *) data;
-    jsval id = INT_TO_JSVAL((unsigned int) *val);
-    if (!JS_SetElement(roots->cx, roots->array, roots->length, &id)) {
-      roots->rval = JS_FALSE;
-      return JS_MAP_GCROOT_STOP;
-    }
-    roots->length++;
+  // rp is a JS GC root. From the documentation for JS_AddRoot() in jsapi.h:
+  //
+  //   A JS GC root is a pointer to a JSObject *, JSString *, or
+  //   jsdouble * that itself points into the GC heap (more recently,
+  //   we support this extension: a root may be a pointer to a jsval v
+  //   for which JSVAL_IS_GCTHING(v) is true).
+  //
+  // The public JSAPI appears to provide no way of actually determining
+  // which it is, though, so we're just going to have to list them all,
+  // and hope that a later tracing will give us more information about
+  // them.
+
+  RootMapStruct *roots = (RootMapStruct *) data;
+  jsval id = INT_TO_JSVAL(*((unsigned int *)rp));
+  if (!JS_SetElement(roots->cx, roots->array, roots->length, &id)) {
+    roots->rval = JS_FALSE;
+    return JS_MAP_GCROOT_STOP;
   }
+  roots->length++;
   return JS_MAP_GCROOT_NEXT;
 }