Backed out 11 changesets (bug 1721333) for causing crashtest/mochitest assertion failures on NativeObject.h. CLOSED TREE

Backed out changeset 64c2f8b78188 (bug 1721333)
Backed out changeset 34e934fb301d (bug 1721333)
Backed out changeset e370430b2eb9 (bug 1721333)
Backed out changeset 6cac736dc557 (bug 1721333)
Backed out changeset a10364bc1e8a (bug 1721333)
Backed out changeset bcab21e83d90 (bug 1721333)
Backed out changeset 34432903f003 (bug 1721333)
Backed out changeset 93f6b564d874 (bug 1721333)
Backed out changeset b99eb964a0e5 (bug 1721333)
Backed out changeset 6ecc217611cd (bug 1721333)
Backed out changeset 5bd8cb5f0cf1 (bug 1721333)

js/src/builtin/MapObject.cpp

@@ -394,7 +394,7 @@ const ClassSpec MapObject::classSpec_ = {
 
 const JSClass MapObject::class_ = {
     "Map",
-    JSCLASS_DELAY_METADATA_BUILDER |
+    JSCLASS_HAS_PRIVATE | JSCLASS_DELAY_METADATA_BUILDER |
         JSCLASS_HAS_RESERVED_SLOTS(MapObject::SlotCount) |
         JSCLASS_HAS_CACHED_PROTO(JSProto_Map) | JSCLASS_FOREGROUND_FINALIZE |
         JSCLASS_SKIP_NURSERY_FINALIZE,
@@ -640,7 +640,7 @@ MapObject* MapObject::create(JSContext* cx,
     return nullptr;
   }
 
-  InitReservedSlot(mapObj, DataSlot, map.release(), MemoryUse::MapObjectTable);
+  InitObjectPrivate(mapObj, map.release(), MemoryUse::MapObjectTable);
   mapObj->initReservedSlot(NurseryKeysSlot, PrivateValue(nullptr));
   mapObj->initReservedSlot(HasNurseryMemorySlot,
                            JS::BooleanValue(insideNursery));
@@ -716,12 +716,11 @@ bool MapObject::construct(JSContext* cx, unsigned argc, Value* vp) {
 
 bool MapObject::is(HandleValue v) {
   return v.isObject() && v.toObject().hasClass(&class_) &&
-         !v.toObject().as<MapObject>().getReservedSlot(DataSlot).isUndefined();
+         v.toObject().as<MapObject>().getPrivate();
 }
 
 bool MapObject::is(HandleObject o) {
-  return o->hasClass(&class_) &&
-         !o->as<MapObject>().getReservedSlot(DataSlot).isUndefined();
+  return o->hasClass(&class_) && o->as<MapObject>().getPrivate();
 }
 
 #define ARG0_KEY(cx, args, key)  \
@@ -1181,7 +1180,7 @@ const ClassSpec SetObject::classSpec_ = {
 
 const JSClass SetObject::class_ = {
     "Set",
-    JSCLASS_DELAY_METADATA_BUILDER |
+    JSCLASS_HAS_PRIVATE | JSCLASS_DELAY_METADATA_BUILDER |
         JSCLASS_HAS_RESERVED_SLOTS(SetObject::SlotCount) |
         JSCLASS_HAS_CACHED_PROTO(JSProto_Set) | JSCLASS_FOREGROUND_FINALIZE |
         JSCLASS_SKIP_NURSERY_FINALIZE,
@@ -1301,7 +1300,7 @@ SetObject* SetObject::create(JSContext* cx,
     return nullptr;
   }
 
-  InitReservedSlot(obj, DataSlot, set.release(), MemoryUse::MapObjectTable);
+  InitObjectPrivate(obj, set.release(), MemoryUse::MapObjectTable);
   obj->initReservedSlot(NurseryKeysSlot, PrivateValue(nullptr));
   obj->initReservedSlot(HasNurseryMemorySlot, JS::BooleanValue(insideNursery));
   return obj;
@@ -1417,12 +1416,11 @@ bool SetObject::construct(JSContext* cx, unsigned argc, Value* vp) {
 
 bool SetObject::is(HandleValue v) {
   return v.isObject() && v.toObject().hasClass(&class_) &&
-         !v.toObject().as<SetObject>().getReservedSlot(DataSlot).isUndefined();
+         v.toObject().as<SetObject>().getPrivate();
 }
 
 bool SetObject::is(HandleObject o) {
-  return o->hasClass(&class_) &&
-         !o->as<SetObject>().getReservedSlot(DataSlot).isUndefined();
+  return o->hasClass(&class_) && o->as<SetObject>().getPrivate();
 }
 
 ValueSet& SetObject::extract(HandleObject o) {

js/src/builtin/MapObject.h

@@ -113,7 +113,7 @@ class MapObject : public NativeObject {
   static const JSClass class_;
   static const JSClass protoClass_;
 
-  enum { DataSlot, NurseryKeysSlot, HasNurseryMemorySlot, SlotCount };
+  enum { NurseryKeysSlot, HasNurseryMemorySlot, SlotCount };
 
   [[nodiscard]] static bool getKeysAndValuesInterleaved(
       HandleObject obj, JS::MutableHandle<GCVector<JS::Value>> entries);
@@ -157,8 +157,7 @@ class MapObject : public NativeObject {
 
   static bool finishInit(JSContext* cx, HandleObject ctor, HandleObject proto);
 
-  ValueMap* getData() { return maybePtrFromReservedSlot<ValueMap>(DataSlot); }
-
+  ValueMap* getData() { return static_cast<ValueMap*>(getPrivate()); }
   static ValueMap& extract(HandleObject o);
   static ValueMap& extract(const CallArgs& args);
   static void trace(JSTracer* trc, JSObject* obj);
@@ -245,7 +244,7 @@ class SetObject : public NativeObject {
   static const JSClass class_;
   static const JSClass protoClass_;
 
-  enum { DataSlot, NurseryKeysSlot, HasNurseryMemorySlot, SlotCount };
+  enum { NurseryKeysSlot, HasNurseryMemorySlot, SlotCount };
 
   [[nodiscard]] static bool keys(JSContext* cx, HandleObject obj,
                                  JS::MutableHandle<GCVector<JS::Value>> keys);
@@ -283,8 +282,7 @@ class SetObject : public NativeObject {
 
   static bool finishInit(JSContext* cx, HandleObject ctor, HandleObject proto);
 
-  ValueSet* getData() { return maybePtrFromReservedSlot<ValueSet>(DataSlot); }
-
+  ValueSet* getData() { return static_cast<ValueSet*>(getPrivate()); }
   static ValueSet& extract(HandleObject o);
   static ValueSet& extract(const CallArgs& args);
   static void trace(JSTracer* trc, JSObject* obj);

js/src/builtin/WeakMapObject-inl.h

@@ -37,8 +37,7 @@ static MOZ_ALWAYS_INLINE bool WeakCollectionPutEntryInternal(
       return false;
     }
     map = newMap.release();
-    InitReservedSlot(obj, WeakCollectionObject::DataSlot, map,
-                     MemoryUse::WeakMapObject);
+    InitObjectPrivate(obj, map, MemoryUse::WeakMapObject);
   }
 
   // Preserve wrapped native keys to prevent wrapper optimization.

js/src/builtin/WeakMapObject.cpp

@@ -286,8 +286,8 @@ const ClassSpec WeakMapObject::classSpec_ = {
 
 const JSClass WeakMapObject::class_ = {
     "WeakMap",
-    JSCLASS_HAS_RESERVED_SLOTS(SlotCount) |
-        JSCLASS_HAS_CACHED_PROTO(JSProto_WeakMap) | JSCLASS_BACKGROUND_FINALIZE,
+    JSCLASS_HAS_PRIVATE | JSCLASS_HAS_CACHED_PROTO(JSProto_WeakMap) |
+        JSCLASS_BACKGROUND_FINALIZE,
     &WeakCollectionObject::classOps_, &WeakMapObject::classSpec_};
 
 const JSClass WeakMapObject::protoClass_ = {

js/src/builtin/WeakMapObject.h

@@ -17,10 +17,8 @@ class GlobalObject;
 // Abstract base class for WeakMapObject and WeakSetObject.
 class WeakCollectionObject : public NativeObject {
  public:
-  enum { DataSlot, SlotCount };
-
   ObjectValueWeakMap* getMap() {
-    return maybePtrFromReservedSlot<ObjectValueWeakMap>(DataSlot);
+    return static_cast<ObjectValueWeakMap*>(getPrivate());
   }
 
   size_t sizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) {

js/src/builtin/WeakSetObject.cpp

@@ -142,8 +142,8 @@ const ClassSpec WeakSetObject::classSpec_ = {
 
 const JSClass WeakSetObject::class_ = {
     "WeakSet",
-    JSCLASS_HAS_RESERVED_SLOTS(SlotCount) |
-        JSCLASS_HAS_CACHED_PROTO(JSProto_WeakSet) | JSCLASS_BACKGROUND_FINALIZE,
+    JSCLASS_HAS_PRIVATE | JSCLASS_HAS_CACHED_PROTO(JSProto_WeakSet) |
+        JSCLASS_BACKGROUND_FINALIZE,
     &WeakCollectionObject::classOps_, &WeakSetObject::classSpec_};
 
 const JSClass WeakSetObject::protoClass_ = {

js/src/debugger/Debugger-inl.h

@@ -17,8 +17,7 @@
 /* static */ inline js::Debugger* js::Debugger::fromJSObject(
     const JSObject* obj) {
   MOZ_ASSERT(obj->is<DebuggerInstanceObject>());
-  auto* dbg = &obj->as<DebuggerInstanceObject>();
-  return dbg->maybePtrFromReservedSlot<Debugger>(JSSLOT_DEBUG_DEBUGGER);
+  return (Debugger*)obj->as<NativeObject>().getPrivate();
 }
 
 inline bool js::Debugger::isHookCallAllowed(JSContext* cx) const {

js/src/debugger/Debugger.cpp

@@ -4015,7 +4015,9 @@ const JSClassOps DebuggerInstanceObject::classOps_ = {
 };
 
 const JSClass DebuggerInstanceObject::class_ = {
-    "Debugger", JSCLASS_HAS_RESERVED_SLOTS(Debugger::JSSLOT_DEBUG_COUNT),
+    "Debugger",
+    JSCLASS_HAS_PRIVATE |
+        JSCLASS_HAS_RESERVED_SLOTS(Debugger::JSSLOT_DEBUG_COUNT),
     &classOps_};
 
 static Debugger* Debugger_fromThisValue(JSContext* cx, const CallArgs& args,
@@ -4633,7 +4635,7 @@ bool Debugger::construct(JSContext* cx, unsigned argc, Value* vp) {
 
     // The object owns the released pointer.
     debugger = dbg.release();
-    InitReservedSlot(obj, JSSLOT_DEBUG_DEBUGGER, debugger, MemoryUse::Debugger);
+    InitObjectPrivate(obj, debugger, MemoryUse::Debugger);
   }
 
   // Add the initial debuggees, if any.

js/src/debugger/Debugger.h

@@ -541,7 +541,6 @@ class Debugger : private mozilla::LinkedListElement<Debugger> {
     HookCount
   };
   enum {
-    JSSLOT_DEBUG_DEBUGGER,
     JSSLOT_DEBUG_PROTO_START,
     JSSLOT_DEBUG_FRAME_PROTO = JSSLOT_DEBUG_PROTO_START,
     JSSLOT_DEBUG_ENV_PROTO,

js/src/debugger/DebuggerMemory.cpp

@@ -68,7 +68,7 @@ bool DebuggerMemory::construct(JSContext* cx, unsigned argc, Value* vp) {
 }
 
 /* static */ const JSClass DebuggerMemory::class_ = {
-    "Memory", JSCLASS_HAS_RESERVED_SLOTS(JSSLOT_COUNT)};
+    "Memory", JSCLASS_HAS_PRIVATE | JSCLASS_HAS_RESERVED_SLOTS(JSSLOT_COUNT)};
 
 /* static */
 DebuggerMemory* DebuggerMemory::checkThis(JSContext* cx, CallArgs& args) {

js/src/jit/BaselineCacheIRCompiler.cpp

@@ -1739,9 +1739,8 @@ bool BaselineCacheIRCompiler::emitGuardAndGetIterator(
 
   // Load our PropertyIteratorObject* and its NativeIterator.
   masm.loadPtr(iterAddr, output);
-
-  Address slotAddr(output, PropertyIteratorObject::offsetOfIteratorSlot());
-  masm.loadPrivate(slotAddr, niScratch);
+  masm.loadObjPrivate(output, PropertyIteratorObject::NUM_FIXED_SLOTS,
+                      niScratch);
 
   // Ensure the iterator is reusable: see NativeIterator::isReusable.
   masm.branchIfNativeIteratorNotReusable(niScratch, failure->label());

js/src/jit/IonCacheIRCompiler.cpp

@@ -1708,9 +1708,8 @@ bool IonCacheIRCompiler::emitGuardAndGetIterator(ObjOperandId objId,
 
   // Load our PropertyIteratorObject* and its NativeIterator.
   masm.movePtr(ImmGCPtr(iterobj), output);
-
-  Address slotAddr(output, PropertyIteratorObject::offsetOfIteratorSlot());
-  masm.loadPrivate(slotAddr, niScratch);
+  masm.loadObjPrivate(output, PropertyIteratorObject::NUM_FIXED_SLOTS,
+                      niScratch);
 
   // Ensure the iterator is reusable: see NativeIterator::isReusable.
   masm.branchIfNativeIteratorNotReusable(niScratch, failure->label());

js/src/jit/MacroAssembler.cpp

@@ -4518,8 +4518,7 @@ static void LoadNativeIterator(MacroAssembler& masm, Register obj,
 #endif
 
   // Load NativeIterator object.
-  Address slotAddr(obj, PropertyIteratorObject::offsetOfIteratorSlot());
-  masm.loadPrivate(slotAddr, dest);
+  masm.loadObjPrivate(obj, PropertyIteratorObject::NUM_FIXED_SLOTS, dest);
 }
 
 void MacroAssembler::iteratorMore(Register obj, ValueOperand output,

js/src/jit/MacroAssembler.h

@@ -4277,6 +4277,10 @@ class MacroAssembler : public MacroAssemblerSpecific {
   template <typename T>
   void storeObjPrivate(T src, const Address& address);
 
+  void loadObjPrivate(Register obj, uint32_t nfixed, Register dest) {
+    loadPtr(Address(obj, NativeObject::getPrivateDataOffset(nfixed)), dest);
+  }
+
   void loadObjProto(Register obj, Register dest) {
     loadPtr(Address(obj, JSObject::offsetOfShape()), dest);
     loadPtr(Address(dest, Shape::offsetOfBaseShape()), dest);

js/src/jsapi-tests/testResolveRecursion.cpp

@@ -5,7 +5,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "js/Object.h"              // JS::GetReservedSlot, JS::SetReservedSlot
+#include "js/Object.h"              // JS::GetPrivate, JS::SetPrivate
 #include "js/PropertyAndElement.h"  // JS_DefineProperty, JS_DefinePropertyById
 #include "jsapi-tests/tests.h"
 
@@ -28,15 +28,15 @@ BEGIN_TEST(testResolveRecursion) {
       nullptr,     // trace
   };
 
-  static const JSClass my_resolve_class = {
-      "MyResolve", JSCLASS_HAS_RESERVED_SLOTS(SlotCount), &my_resolve_classOps};
+  static const JSClass my_resolve_class = {"MyResolve", JSCLASS_HAS_PRIVATE,
+                                           &my_resolve_classOps};
 
   obj1.init(cx, JS_NewObject(cx, &my_resolve_class));
   CHECK(obj1);
   obj2.init(cx, JS_NewObject(cx, &my_resolve_class));
   CHECK(obj2);
-  JS::SetReservedSlot(obj1, TestSlot, JS::PrivateValue(this));
-  JS::SetReservedSlot(obj2, TestSlot, JS::PrivateValue(this));
+  JS::SetPrivate(obj1, this);
+  JS::SetPrivate(obj2, this);
 
   JS::RootedValue obj1Val(cx, JS::ObjectValue(*obj1));
   JS::RootedValue obj2Val(cx, JS::ObjectValue(*obj2));
@@ -58,8 +58,6 @@ BEGIN_TEST(testResolveRecursion) {
   return true;
 }
 
-enum Slots { TestSlot, SlotCount };
-
 JS::PersistentRootedObject obj1;
 JS::PersistentRootedObject obj2;
 int resolveEntryCount;
@@ -135,9 +133,8 @@ bool doResolve(JS::HandleObject obj, JS::HandleId id, bool* resolvedp) {
 
 static bool my_resolve(JSContext* cx, JS::HandleObject obj, JS::HandleId id,
                        bool* resolvedp) {
-  void* p = JS::GetReservedSlot(obj, TestSlot).toPrivate();
-  return static_cast<cls_testResolveRecursion*>(p)->doResolve(obj, id,
-                                                              resolvedp);
+  return static_cast<cls_testResolveRecursion*>(JS::GetPrivate(obj))
+      ->doResolve(obj, id, resolvedp);
 }
 END_TEST(testResolveRecursion)
 

js/src/jsapi-tests/testWeakMap.cpp

@@ -165,7 +165,7 @@ static size_t DelegateObjectMoved(JSObject* obj, JSObject* old) {
 
 JSObject* newKey() {
   static const JSClass keyClass = {
-      "keyWithDelegate", JSCLASS_HAS_RESERVED_SLOTS(1),
+      "keyWithDelegate", JSCLASS_HAS_PRIVATE | JSCLASS_HAS_RESERVED_SLOTS(1),
       JS_NULL_CLASS_OPS, JS_NULL_CLASS_SPEC,
       JS_NULL_CLASS_EXT, JS_NULL_OBJECT_OPS};
 

js/src/vm/GlobalObject.cpp

@@ -928,7 +928,7 @@ RegExpStatics* GlobalObject::getRegExpStatics(JSContext* cx,
   } else {
     resObj = &val.toObject().as<RegExpStaticsObject>();
   }
-  return resObj->regExpStatics();
+  return static_cast<RegExpStatics*>(resObj->getPrivate(/* nfixed = */ 1));
 }
 
 /* static */

js/src/vm/Iteration.cpp

@@ -598,6 +598,8 @@ static PropertyIteratorObject* NewPropertyIteratorObject(JSContext* cx) {
   // CodeGenerator::visitIteratorStartO assumes the iterator object is not
   // inside the nursery when deciding whether a barrier is necessary.
   MOZ_ASSERT(!js::gc::IsInsideNursery(res));
+
+  MOZ_ASSERT(res->numFixedSlots() == PropertyIteratorObject::NUM_FIXED_SLOTS);
   return res;
 }
 
@@ -714,7 +716,7 @@ NativeIterator::NativeIterator(JSContext* cx,
   //       because it has GCPtr fields whose barriers have already fired; the
   //       store buffer has pointers to them. Only the GC can free `this` (via
   //       PropertyIteratorObject::finalize).
-  propIter->initNativeIterator(this);
+  propIter->setNativeIterator(this);
 
   // The GC asserts on finalization that `this->allocationSize()` matches the
   // `nbytes` passed to `AddCellMemory`. So once these lines run, we must make
@@ -1112,8 +1114,7 @@ const JSClassOps PropertyIteratorObject::classOps_ = {
 };
 
 const JSClass PropertyIteratorObject::class_ = {
-    "Iterator",
-    JSCLASS_HAS_RESERVED_SLOTS(SlotCount) | JSCLASS_BACKGROUND_FINALIZE,
+    "Iterator", JSCLASS_HAS_PRIVATE | JSCLASS_BACKGROUND_FINALIZE,
     &PropertyIteratorObject::classOps_};
 
 static const JSClass ArrayIteratorPrototypeClass = {"Array Iterator", 0};

js/src/vm/Iteration.h

@@ -365,24 +365,20 @@ struct NativeIterator {
 class PropertyIteratorObject : public NativeObject {
   static const JSClassOps classOps_;
 
-  enum { IteratorSlot, SlotCount };
-
  public:
   static const JSClass class_;
 
+  // We don't use the fixed slot but the JITs use this constant to load the
+  // private value (the NativeIterator*).
+  static const uint32_t NUM_FIXED_SLOTS = 1;
+
   NativeIterator* getNativeIterator() const {
-    return maybePtrFromReservedSlot<NativeIterator>(IteratorSlot);
-  }
-  void initNativeIterator(js::NativeIterator* ni) {
-    initReservedSlot(IteratorSlot, PrivateValue(ni));
+    return static_cast<js::NativeIterator*>(getPrivate());
   }
+  void setNativeIterator(js::NativeIterator* ni) { setPrivate(ni); }
 
   size_t sizeOfMisc(mozilla::MallocSizeOf mallocSizeOf) const;
 
-  static size_t offsetOfIteratorSlot() {
-    return getFixedSlotOffset(IteratorSlot);
-  }
-
  private:
   static void trace(JSTracer* trc, JSObject* obj);
   static void finalize(JSFreeOp* fop, JSObject* obj);

js/src/vm/NativeObject.h

@@ -1179,12 +1179,6 @@ class NativeObject : public JSObject {
     fixedSlots()[slot].init(this, HeapSlot::Slot, slot, value);
   }
 
-  template <typename T>
-  T* maybePtrFromReservedSlot(uint32_t slot) const {
-    Value v = getReservedSlot(slot);
-    return v.isUndefined() ? nullptr : static_cast<T*>(v.toPrivate());
-  }
-
   /*
    * Calculate the number of dynamic slots to allocate to cover the properties
    * in an object with the given number of fixed slots and slot span.

js/src/vm/PIC.cpp

@@ -339,8 +339,7 @@ static const JSClassOps ForOfPICClassOps = {
 };
 
 const JSClass ForOfPICObject::class_ = {
-    "ForOfPIC",
-    JSCLASS_HAS_RESERVED_SLOTS(SlotCount) | JSCLASS_BACKGROUND_FINALIZE,
+    "ForOfPIC", JSCLASS_HAS_PRIVATE | JSCLASS_BACKGROUND_FINALIZE,
     &ForOfPICClassOps};
 
 /* static */
@@ -356,7 +355,8 @@ NativeObject* js::ForOfPIC::createForOfPICObject(JSContext* cx,
   if (!chain) {
     return nullptr;
   }
-  InitReservedSlot(obj, ForOfPICObject::ChainSlot, chain, MemoryUse::ForOfPIC);
+  InitObjectPrivate(obj, chain, MemoryUse::ForOfPIC);
+  obj->setPrivate(chain);
   return obj;
 }
 

js/src/vm/PIC.h

@@ -79,8 +79,6 @@ class PICChain {
 // Class for object that holds ForOfPIC chain.
 class ForOfPICObject : public NativeObject {
  public:
-  enum { ChainSlot, SlotCount };
-
   static const JSClass class_;
 };
 
@@ -227,7 +225,7 @@ struct ForOfPIC {
 
   static inline Chain* fromJSObject(NativeObject* obj) {
     MOZ_ASSERT(obj->is<ForOfPICObject>());
-    return obj->maybePtrFromReservedSlot<Chain>(ForOfPICObject::ChainSlot);
+    return (ForOfPIC::Chain*)obj->getPrivate();
   }
   static inline Chain* getOrCreate(JSContext* cx) {
     NativeObject* obj = cx->global()->getForOfPICObject();

js/src/vm/RegExpStatics.cpp

@@ -22,13 +22,15 @@ using namespace js;
 
 static void resc_finalize(JSFreeOp* fop, JSObject* obj) {
   MOZ_ASSERT(fop->onMainThread());
-  RegExpStatics* res = obj->as<RegExpStaticsObject>().regExpStatics();
+  RegExpStatics* res =
+      static_cast<RegExpStatics*>(obj->as<RegExpStaticsObject>().getPrivate());
   fop->delete_(obj, res, MemoryUse::RegExpStatics);
 }
 
 static void resc_trace(JSTracer* trc, JSObject* obj) {
-  if (RegExpStatics* data = obj->as<RegExpStaticsObject>().regExpStatics()) {
-    data->trace(trc);
+  void* pdata = obj->as<RegExpStaticsObject>().getPrivate();
+  if (pdata) {
+    static_cast<RegExpStatics*>(pdata)->trace(trc);
   }
 }
 
@@ -47,8 +49,7 @@ static const JSClassOps RegExpStaticsObjectClassOps = {
 };
 
 const JSClass RegExpStaticsObject::class_ = {
-    "RegExpStatics",
-    JSCLASS_HAS_RESERVED_SLOTS(SlotCount) | JSCLASS_FOREGROUND_FINALIZE,
+    "RegExpStatics", JSCLASS_HAS_PRIVATE | JSCLASS_FOREGROUND_FINALIZE,
     &RegExpStaticsObjectClassOps};
 
 RegExpStaticsObject* RegExpStatics::create(JSContext* cx) {
@@ -63,8 +64,7 @@ RegExpStaticsObject* RegExpStatics::create(JSContext* cx) {
   }
   // TODO: This doesn't account for match vector heap memory used if there are
   // more 10 matches. This is likely to be rare.
-  InitReservedSlot(obj, RegExpStaticsObject::StaticsSlot, res,
-                   MemoryUse::RegExpStatics);
+  InitObjectPrivate(obj, res, MemoryUse::RegExpStatics);
   return obj;
 }
 

js/src/vm/RegExpStaticsObject.h

@@ -11,24 +11,14 @@
 
 namespace js {
 
-class RegExpStatics;
-
 class RegExpStaticsObject : public NativeObject {
-  friend class js::RegExpStatics;
-
-  enum { StaticsSlot, SlotCount };
-
  public:
   static const JSClass class_;
 
-  RegExpStatics* regExpStatics() const {
-    return maybePtrFromReservedSlot<RegExpStatics>(StaticsSlot);
-  }
-
   size_t sizeOfData(mozilla::MallocSizeOf mallocSizeOf) {
     // XXX: should really call RegExpStatics::sizeOfIncludingThis() here
     // instead, but the extra memory it would measure is insignificant.
-    return mallocSizeOf(regExpStatics());
+    return mallocSizeOf(getPrivate());
   }
 };
 

js/src/vm/SavedStacks.cpp

@@ -372,7 +372,7 @@ const ClassSpec SavedFrame::classSpec_ = {
 
 /* static */ const JSClass SavedFrame::class_ = {
     "SavedFrame",
-    JSCLASS_HAS_RESERVED_SLOTS(SavedFrame::JSSLOT_COUNT) |
+    JSCLASS_HAS_PRIVATE | JSCLASS_HAS_RESERVED_SLOTS(SavedFrame::JSSLOT_COUNT) |
         JSCLASS_HAS_CACHED_PROTO(JSProto_SavedFrame) |
         JSCLASS_FOREGROUND_FINALIZE,
     &SavedFrameClassOps, &SavedFrame::classSpec_};

js/src/wasm/WasmJS.cpp

@@ -3681,7 +3681,7 @@ const JSClassOps WasmRuntimeExceptionObject::classOps_ = {
 const JSClass WasmRuntimeExceptionObject::class_ = {
     "WebAssembly.RuntimeException",
     JSCLASS_HAS_RESERVED_SLOTS(WasmRuntimeExceptionObject::RESERVED_SLOTS) |
-        JSCLASS_FOREGROUND_FINALIZE,
+        JSCLASS_HAS_PRIVATE | JSCLASS_FOREGROUND_FINALIZE,
     &WasmRuntimeExceptionObject::classOps_,
     &WasmRuntimeExceptionObject::classSpec_};