Backed out changeset 1732da7b3164

js/src/jsinterp.cpp

@@ -349,6 +349,12 @@ js_FillPropertyCache(JSContext *cx, JSObject *obj,
             /*
              * Make sure that a later shadowing assignment will enter
              * PurgeProtoChain and invalidate this entry, bug 479198.
+             *
+             * This is thread-safe even though obj is not locked. Only the
+             * DELEGATE bit of obj->classword can change at runtime, given that
+             * obj is native; and the bit is only set, never cleared. And on
+             * platforms where another CPU can fail to see this write, it's OK
+             * because the property cache and JIT cache are thread-local.
              */
             obj->setDelegate();
         }

js/src/jsobj.cpp

@@ -6745,34 +6745,6 @@ JSObject::isCallable()
     return !!map->ops->call;
 }
 
-void
-JSObject::setClass(const JSClass *clasp)
-{
-    JS_ASSERT((jsuword(clasp) & 3) == 0);
-    jsuword ov, nv;
-
-    do {
-        ov = classword;
-        nv = jsuword(clasp) | (ov & 3);
-    } while (!js_CompareAndSwap((jsword *)&classword, ov, nv));
-}
-
-void
-JSObject::setDelegate()
-{
-    if (classword & jsuword(1))
-        return;
-    JS_ATOMIC_SET_MASK(&classword, 1);
-}
-
-void
-JSObject::setSystem()
-{
-    if (classword & jsuword(2))
-        return;
-    JS_ATOMIC_SET_MASK(&classword, 2);
-}
-
 JSBool
 js_ReportGetterOnlyAssignment(JSContext *cx)
 {

js/src/jsobj.h

@@ -263,13 +263,13 @@ struct JSObject {
         return clasp == getClass();
     }
 
-    void setClass(const JSClass *clasp);
-
     bool isDelegate() const {
         return (classword & jsuword(1)) != jsuword(0);
     }
 
-    void setDelegate();
+    void setDelegate() {
+        classword |= jsuword(1);
+    }
 
     static void setDelegateNullSafe(JSObject *obj) {
         if (obj)
@@ -280,7 +280,9 @@ struct JSObject {
         return (classword & jsuword(2)) != jsuword(0);
     }
 
-    void setSystem();
+    void setSystem() {
+        classword |= jsuword(2);
+    }
 
     JSObject *getProto() const {
         return JSVAL_TO_OBJECT(fslots[JSSLOT_PROTO]);