Make GCF_SYSTEM immutable per object (396487, r=igor).

dom/src/base/nsJSEnvironment.cpp

@@ -2257,9 +2257,10 @@ nsJSContext::InitContext(nsIScriptGlobalObject *aGlobalObject)
     PRUint32 flags = 0;
     
     if (chromeWindow) {
-      // Flag this object and scripts compiled against it as "system", for
+      // Flag this context and scripts compiled against it as "system", for
       // optional automated XPCNativeWrapper construction when chrome views
       // a content DOM.
+      ::JS_FlagSystemContext(mContext);
       flags = nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT;
 
       // Always enable E4X for XUL and other chrome content -- there is no

js/src/jscntxt.h

@@ -643,10 +643,10 @@ struct JSContext {
      * property values associated with this context's global object.
      */
     uint8               xmlSettingFlags;
-    uint8               padding;
 #else
-    uint16              padding;
+    uint8               padding;
 #endif
+    uint8               gcDefaultFlags;
 
     /* Runtime version control identifier. */
     uint16              version;

js/src/jsdbgapi.c

@@ -1632,12 +1632,9 @@ JS_IsSystemObject(JSContext *cx, JSObject *obj)
 }
 
 JS_PUBLIC_API(void)
-JS_FlagSystemObject(JSContext *cx, JSObject *obj)
+JS_FlagSystemContext(JSContext *cx)
 {
-    uint8 *flagp;
-
-    flagp = js_GetGCThingFlags(obj);
-    *flagp |= GCF_SYSTEM;
+    cx->gcDefaultFlags = GCF_SYSTEM;
 }
 
 /************************************************************************/

js/src/jsdbgapi.h

@@ -393,22 +393,25 @@ JS_FlagScriptFilenamePrefix(JSRuntime *rt, const char *prefix, uint32 flags);
 #define JSFILENAME_SYSTEM       0x00000001      /* "system" script, see below */
 
 /*
- * Return true if obj is a "system" object, that is, one flagged by a prior
- * call to JS_FlagSystemObject(cx, obj).  What "system" means is up to the API
- * client, but it can be used to coordinate access control policies based on
- * script filenames and their prefixes, using JS_FlagScriptFilenamePrefix and
- * JS_GetTopScriptFilenameFlags.
+ * Return true if obj is a "system" object, that is, one parented by a system
+ * object, or if obj's parent is null, one created on a context flagged as a
+ * system context by JS_FlagSystemContext.
+ *
+ * What "system" means is up to the API client, but it can be used to implement
+ * access control policies based on script filenames and their prefixes, using
+ * JS_FlagScriptFilenamePrefix and JS_GetTopScriptFilenameFlags.
  */
 extern JS_PUBLIC_API(JSBool)
 JS_IsSystemObject(JSContext *cx, JSObject *obj);
 
 /*
- * Flag obj as a "system" object.  The API client can flag system objects to
- * optimize access control checks.  The engine stores but does not interpret
- * the per-object flag set by this call.
+ * Flag cx as a "system" context. The API client can flag system contexts to
+ * optimize access control checks. The engine stores, but does not interpret,
+ * the per-context flag set by this call, and uses it when new GC-things are
+ * created on cx.
  */
 extern JS_PUBLIC_API(void)
-JS_FlagSystemObject(JSContext *cx, JSObject *obj);
+JS_FlagSystemContext(JSContext *cx);
 
 /************************************************************************/
 

js/src/jsgc.c

@@ -1563,7 +1563,7 @@ js_NewGCThing(JSContext *cx, uintN flags, size_t nbytes)
     }
 
     /* We can't fail now, so update flags. */
-    *flagp = (uint8)flags;
+    *flagp = (uint8)flags | cx->gcDefaultFlags;
 
 #ifdef DEBUG_gchist
     gchist[gchpos].lastDitch = doGC;

js/src/jsobj.c

@@ -2431,6 +2431,7 @@ JSObject *
 js_NewObject(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
 {
     jsid id;
+    uintN gcflags;
     JSObject *obj;
     JSObjectOps *ops;
     JSObjectMap *map;
@@ -2451,17 +2452,20 @@ js_NewObject(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
         }
     }
 
-    /* Always call the class's getObjectOps hook if it has one. */
-    ops = clasp->getObjectOps
-          ? clasp->getObjectOps(cx, clasp)
-          : &js_ObjectOps;
+    /*
+     * Require that obj has the same system flag as its parent or (if null)
+     * its context's default system flag (see js_NewGCThing).
+     */
+    gcflags = GCX_OBJECT;
+    if (parent)
+        gcflags |= *js_GetGCThingFlags(parent) & GCF_SYSTEM;
 
     /*
      * Allocate a zeroed object from the GC heap.  Do this *after* any other
      * GC-thing allocations under js_GetClassPrototype or clasp->getObjectOps,
      * to avoid displacing the newborn root for obj.
      */
-    obj = (JSObject *) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
+    obj = (JSObject *) js_NewGCThing(cx, gcflags, sizeof(JSObject));
     if (!obj)
         return NULL;
 
@@ -2481,6 +2485,11 @@ js_NewObject(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
     for (i = JSSLOT_PRIVATE; i != JS_INITIAL_NSLOTS; ++i)
         obj->fslots[i] = JSVAL_VOID;
 
+    /* Always call the class's getObjectOps hook if it has one. */
+    ops = clasp->getObjectOps
+          ? clasp->getObjectOps(cx, clasp)
+          : &js_ObjectOps;
+
     /*
      * Root obj to prevent it from being collected out from under this call to
      * js_NewObject. There's a possibilty of GC under the objectHook call-out

js/src/xpconnect/loader/mozJSComponentLoader.cpp

@@ -74,6 +74,7 @@
 #include "nsIFileURL.h"
 #include "nsNetUtil.h"
 #endif
+#include "jsdbgapi.h"
 #include "jsxdrapi.h"
 #include "jsprf.h"
 #include "nsIFastLoadFileControl.h"
@@ -509,6 +510,8 @@ mozJSComponentLoader::ReallyInit()
     if (!mContext)
         return NS_ERROR_OUT_OF_MEMORY;
 
+    JS_FlagSystemContext(mContext);
+
     uint32 options = JS_GetOptions(mContext);
     JS_SetOptions(mContext, options | JSOPTION_XML);
 

js/src/xpconnect/src/nsXPConnect.cpp

@@ -982,8 +982,9 @@ nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext * aJSContext,
        !JS_SetPrototype(aJSContext, tempGlobal, nsnull))
         return UnexpectedFailure(NS_ERROR_FAILURE);
 
-    if(aFlags & nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT)
-        JS_FlagSystemObject(aJSContext, tempGlobal);
+    NS_ASSERTION(!(aFlags & nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT) ||
+                 JS_IsSystemObject(aJSContext, tempGlobal),
+                 "system flag mismatch");
 
     nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
     {

js/src/xpconnect/src/xpcwrappednative.cpp

@@ -871,10 +871,6 @@ XPCWrappedNative::Init(XPCCallContext& ccx, JSObject* parent, JSBool isGlobal,
         return JS_FALSE;
     }
 
-    // Propagate the system flag from parent to child.
-    if(JS_IsSystemObject(ccx, parent))
-        JS_FlagSystemObject(ccx, mFlatJSObject);
-
     // This reference will be released when mFlatJSObject is finalized.
     // Since this reference will push the refcount to 2 it will also root
     // mFlatJSObject;
@@ -1721,10 +1717,6 @@ XPCWrappedNative::InitTearOffJSObject(XPCCallContext& ccx,
     if(!obj || !JS_SetPrivate(ccx, obj, to))
         return JS_FALSE;
 
-    // Propagate the system flag from parent to child.
-    if(JS_IsSystemObject(ccx, mFlatJSObject))
-        JS_FlagSystemObject(ccx, obj);
-
     to->SetJSObject(obj);
     return JS_TRUE;
 }

js/src/xpconnect/src/xpcwrappednativeproto.cpp

@@ -112,10 +112,6 @@ XPCWrappedNativeProto::Init(
 
     JSBool ok = mJSProtoObject && JS_SetPrivate(ccx, mJSProtoObject, this);
 
-    // Propagate the system flag from parent to child.
-    if(ok && JS_IsSystemObject(ccx, parent))
-        JS_FlagSystemObject(ccx, mJSProtoObject);
-
     DEBUG_ReportShadowedMembers(mSet, nsnull, this);
 
     return ok;