Just curious. How does this stack scanning achieve its feat? Is it by
simply looking at the Spidermonkey process stack and looks for
something that looks like an address and that address so happen points
to a valid heap object? For one thing, to a process, the stack is
just an unstructured array of bytes. How does stack scanning knows a
function is referencing a JSObject? This is even no way we can tell
by looking at the stack that some particular 4 bytes are actually a
32bit pointer.