typedef uint64 value; // if object then contains pointer to memory

value csf_native_function(VM* c, value obj, value p1, value p2) {

  if( !cs_is_string(p1) )
    p1 = cs_allocate_string(c, ' ', 256); // may cause GC()
  // obj, p1, p2 could be wrong at this point due to GC in the line above
  return csf_other_func(c, obj, p1, p2);
}

value csf_native_function(VM* c, value obj, value p1, value p2) {
  PROTECT(c, obj, p1, p2);
  if( !cs_is_string(p1) )
    p1 = cs_allocate_string(c, ' ', 256); // may cause GC()
  // obj, p1, p2 could be wrong at this point due to GC in the line above
  return csf_other_func(c, obj, p1, p2);
}

cs_push_var_address(c, &obj);
cs_push_var_address(c, &p1);
cs_push_var_address(c, &p2);

...

// at destructor
cs_pop_var_addresses(c,3)

value csf_native_function(VM* c, value obj, value p1, value p2) {
  if( !cs_is_string(p1) )
    p1 = cs_allocate_string(c, ' ', 256); // may cause GC()
  // obj, p1, p2 could be wrong at this point due to GC in the line above
  return csf_other_func(c, obj, p1, p2);
}

struct managed_value {
  VM*    c;
  value  v;

  managed_value(VM* ct, value va): c(ct), v(va) { c->push_address(&v); }
  ~managed_value(): c(ct), v(va) { c->pop_address(); }
}

CS>struct managed_value {
CS>  VM*    c;
CS>  value  v;

CS>  managed_value(VM* ct, value va): c(ct), v(va) { c->push_address(&v); }
CS>  ~managed_value(): c(ct), v(va) { c->pop_address(); }
CS>} 
CS>

struct float_value
 {
  value v;
 };

struct pinned_value
 {
  value v;
 };

class protect : NoCopy
 {
   VM *vm;
   pinned_value val;

  public:

   protect(VM *vm,float_value val);

   ~protect();

   operator pinned_value() const { return val; } 
 };

CS>>value csf_native_function(VM* c, value obj, value p1, value p2) {
CS>>  PROTECT(c, obj, p1, p2);
CS>>

void vm::collect_garbage() {
  ...
  value dummy;
  void* p = &dummy; // c stack top 
  void* pend = c_stack_bottom;
  for(; p < pend; ++p )
    if( looks_like_value_address(p))
      *((value*)p) = copy_value( *((value*)p) );
  ...
}

value obj, p1, p2;

// PROTECT ctor:
cs_push_var_address(c, &obj);
cs_push_var_address(c, &p1);
cs_push_var_address(c, &p2);

some_allocating_function(c);
// obj, p1, p2 may have different values here due to GC

// PROTECT dtor:
cs_pop_var_addresses(c,3)

All GC thing pointers stored on the stack (i.e., local variables and parameters to functions) must use the JS::Rooted<T> class.
...
SpiderMonkey makes it easy to remember to use JS::Rooted<T> types instead of a raw pointer because all of the API methods that may GC take a JS::Handle<T>, as described below.
...
All GC thing pointers that are parameters to a function must be wrapped in JS::Handle<T>. A JS::Handle<T> is a reference to a JS::Rooted<T>. All JS::Handle<T> are created implicitly by referencing a JS::Rooted<T>: It is not valid to create a JS::Handle<T> manually. Like JS::Rooted<T>, a JS::Handle<T> can be used as if it were the underlying pointer.

Since only a JS::Rooted<T> will cast to a JS::Handle<T>, the compiler will enforce correct rooting of any parameters passed to a function that may trigger GC. JS::Handle<T> exists because creating and destroying a JS::Rooted<T> is not free (though it only costs a few cycles). Thus, it makes more sense to only root the GC thing once and reuse it through an indirect reference. Like a reference, a JS::Handle is immutable: it can only ever refer to the JS::Rooted<T> that it was created for.

void foo(VM* vm, managed_pointer const& p1, managed_pointer const& p2) {
  // если хочется работать с локальной копией - создаём и знакомим мусорщик с ней
  managed_pointer q1, q3, q4;
  BEGIN_TRACK(vm, &q1, &q3, &q4); // не залочили, а запомнили, что на стеке есть такая штука
                                  // пару BEGIN_TRACK - END_TRACK можно засахарить в раии SCOPED_TRACK
  q1 = p1;
  ...
  assert(p1 == q1); // мусорщик должен синхронно обновлять значения (адреса объектов) подконтрольных указателей
  ...
  bar(vm, p2);
  ...
  bar(vm, p2);
  ...
  END_TRACK(vm, &q1, &q3, &q4);
}

using managed_pointer_ref = std::cref(managed_pointer);

void foo(VM* vm, managed_pointer_ref p1, managed_pointer_ref p2);

void foo(VM* vm, managed_pointer const& p1, managed_pointer const& p2) {
  scoped_managed_pointer q1(vm), q3(vm); // которые нельзя просто так сконструировать - только через знакомство с мусорщиком
  scoped_managed_pointer q2(vm, p2);
  q1 = p1;
}

#define SCOPED_MP(vm, name) managed_pointer name; BEGIN_TRACK(vm, &name); SCOPED_EXIT({ END_TRACK(vm, &name); })

void foo(VM* vm) {
  SCOPED_MP(vm, q1);
  SCOPED_MP(vm, q3);
  SCOPED_MP(vm, q4);
  ...
}

К>using managed_pointer_ref = std::cref(managed_pointer);

К>void foo(VM* vm, managed_pointer_ref p1, managed_pointer_ref p2);
К>

All GC thing pointers that are parameters to a function must be wrapped in JS::Handle<T>. A JS::Handle<T> is a reference to a JS::Rooted<T>. All JS::Handle<T> are created implicitly by referencing a JS::Rooted<T>: It is not valid to create a JS::Handle<T> manually. Like JS::Rooted<T>, a JS::Handle<T> can be used as if it were the underlying pointer.

Since only a JS::Rooted<T> will cast to a JS::Handle<T>, the compiler will enforce correct rooting of any parameters passed to a function that may trigger GC. JS::Handle<T> exists because creating and destroying a JS::Rooted<T> is not free (though it only costs a few cycles). Thus, it makes more sense to only root the GC thing once and reuse it through an indirect reference. Like a reference, a JS::Handle is immutable: it can only ever refer to the JS::Rooted<T> that it was created for.

E>Ты так и не ответил этот PROTECT — дорогой выходит? Или можно просто в каждой проксе его звать?

void cs_push_var_address(c, value &var) {
  c->vars_on_c_stack[ c->vars_on_c_stack_top++ ] = &var;
}

void cs_pop_var_addresses(c, int n) {
  c->vars_on_c_stack_top -= n;
}

CS>void cs_push_var_address(c, value &var) {
  c->>vars_on_c_stack[ c->vars_on_c_stack_top++ ] = &var;
CS>}

CS>void cs_pop_var_addresses(c, int n) {
  c->>vars_on_c_stack_top -= n;
CS>}
CS>

template<class T>
class VM_proxy {
       T volatile *& ptr;
       VM* const c;

       void operator = ( const VM_proxy& );  // = delete
   public:
       VM_proxy( const VM_proxy& o ) : ptr( o.ptr), c( o.c ) // по уму надо сделать доступным только для двух методов smart_VM_ptr, но тут лень. 
           { cs_push_var_address( c, &ptr ); }


       VM_proxy( T volatile *& ptr_, VM* c_ ) : ptr( ptr_ ), c( c_ ) 
           { cs_push_var_address( c, &ptr ); }
       ~VM_proxy() 
           { cs_pop_var_addresses( c, 1 ); }

      operator T*() { retrun ptr; }
      T* operator->() { return ptr; }
};

class VM_switcher {
    static VM* current; // = 0;
    VM* prev;
 
    VM_switcher( const VM_switcher& ); // = delete;
    void operator = (const VM_switcher& ); // = delete;
public:
    static GetCurrent() { assert( current!= 0 ); return current; }
    VM_switcher( VM* newCurrent ) : prev( current )
        { assert( newCurrent != 0 ); current = newCurrent; }
    ~VM_switcher() { current = prev; }
};

template<class T> 
class smart_VM_ptr {
    T volatile * ptr;
public:
   // конструкторы по вкусу

   VM_proxy<T> Get( VM* c = VM_switcher::GetCurrent() ) 
       { return proxy_VM<T>( ptr, c ); }
   VM_proxy<T> operator->() 
       { return proxyVM<T>( ptr,  VM_switcher::GetCurrent() ); }
   VM_proxy<const T> Get( VM* c = VM_switcher::GetCurrent() ) const 
       { return proxy_VM<const T>( ptr, c ); }
   VM_proxy<cont T> operator->() const 
       { return proxyVM<const T>( ptr,  VM_switcher::GetCurrent() ); }
   
};