Back-out due to test failure.

dom/src/base/nsJSEnvironment.cpp

@@ -2257,10 +2257,9 @@ nsJSContext::InitContext(nsIScriptGlobalObject *aGlobalObject)
     PRUint32 flags = 0;
     
     if (chromeWindow) {
-      // Flag this context and scripts compiled against it as "system", for
+      // Flag this object and scripts compiled against it as "system", for
       // optional automated XPCNativeWrapper construction when chrome views
       // a content DOM.
-      ::JS_FlagSystemContext(mContext);
       flags = nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT;
 
       // Always enable E4X for XUL and other chrome content -- there is no

js/src/jscntxt.h

@@ -643,10 +643,10 @@ struct JSContext {
      * property values associated with this context's global object.
      */
     uint8               xmlSettingFlags;
-#else
     uint8               padding;
+#else
+    uint16              padding;
 #endif
-    uint8               gcDefaultFlags;
 
     /* Runtime version control identifier. */
     uint16              version;

js/src/jsdbgapi.c

@@ -1632,9 +1632,12 @@ JS_IsSystemObject(JSContext *cx, JSObject *obj)
 }
 
 JS_PUBLIC_API(void)
-JS_FlagSystemContext(JSContext *cx)
+JS_FlagSystemObject(JSContext *cx, JSObject *obj)
 {
-    cx->gcDefaultFlags = GCF_SYSTEM;
+    uint8 *flagp;
+
+    flagp = js_GetGCThingFlags(obj);
+    *flagp |= GCF_SYSTEM;
 }
 
 /************************************************************************/

js/src/jsdbgapi.h

@@ -393,25 +393,22 @@ JS_FlagScriptFilenamePrefix(JSRuntime *rt, const char *prefix, uint32 flags);
 #define JSFILENAME_SYSTEM       0x00000001      /* "system" script, see below */
 
 /*
- * Return true if obj is a "system" object, that is, one parented by a system
- * object, or if obj's parent is null, one created on a context flagged as a
- * system context by JS_FlagSystemContext.
- *
- * What "system" means is up to the API client, but it can be used to implement
- * access control policies based on script filenames and their prefixes, using
- * JS_FlagScriptFilenamePrefix and JS_GetTopScriptFilenameFlags.
+ * Return true if obj is a "system" object, that is, one flagged by a prior
+ * call to JS_FlagSystemObject(cx, obj).  What "system" means is up to the API
+ * client, but it can be used to coordinate access control policies based on
+ * script filenames and their prefixes, using JS_FlagScriptFilenamePrefix and
+ * JS_GetTopScriptFilenameFlags.
  */
 extern JS_PUBLIC_API(JSBool)
 JS_IsSystemObject(JSContext *cx, JSObject *obj);
 
 /*
- * Flag cx as a "system" context. The API client can flag system contexts to
- * optimize access control checks. The engine stores, but does not interpret,
- * the per-context flag set by this call, and uses it when new GC-things are
- * created on cx.
+ * Flag obj as a "system" object.  The API client can flag system objects to
+ * optimize access control checks.  The engine stores but does not interpret
+ * the per-object flag set by this call.
  */
 extern JS_PUBLIC_API(void)
-JS_FlagSystemContext(JSContext *cx);
+JS_FlagSystemObject(JSContext *cx, JSObject *obj);
 
 /************************************************************************/
 

js/src/jsgc.c

@@ -1563,7 +1563,7 @@ js_NewGCThing(JSContext *cx, uintN flags, size_t nbytes)
     }
 
     /* We can't fail now, so update flags. */
-    *flagp = (uint8)flags | cx->gcDefaultFlags;
+    *flagp = (uint8)flags;
 
 #ifdef DEBUG_gchist
     gchist[gchpos].lastDitch = doGC;

js/src/jsobj.c

@@ -2431,7 +2431,6 @@ JSObject *
 js_NewObject(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
 {
     jsid id;
-    uintN gcflags;
     JSObject *obj;
     JSObjectOps *ops;
     JSObjectMap *map;
@@ -2452,20 +2451,17 @@ js_NewObject(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
         }
     }
 
-    /*
-     * Require that obj has the same system flag as its parent or (if null)
-     * its context's default system flag (see js_NewGCThing).
-     */
-    gcflags = GCX_OBJECT;
-    if (parent)
-        gcflags |= *js_GetGCThingFlags(parent) & GCF_SYSTEM;
+    /* Always call the class's getObjectOps hook if it has one. */
+    ops = clasp->getObjectOps
+          ? clasp->getObjectOps(cx, clasp)
+          : &js_ObjectOps;
 
     /*
      * Allocate a zeroed object from the GC heap.  Do this *after* any other
      * GC-thing allocations under js_GetClassPrototype or clasp->getObjectOps,
      * to avoid displacing the newborn root for obj.
      */
-    obj = (JSObject *) js_NewGCThing(cx, gcflags, sizeof(JSObject));
+    obj = (JSObject *) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject));
     if (!obj)
         return NULL;
 
@@ -2485,11 +2481,6 @@ js_NewObject(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
     for (i = JSSLOT_PRIVATE; i != JS_INITIAL_NSLOTS; ++i)
         obj->fslots[i] = JSVAL_VOID;
 
-    /* Always call the class's getObjectOps hook if it has one. */
-    ops = clasp->getObjectOps
-          ? clasp->getObjectOps(cx, clasp)
-          : &js_ObjectOps;
-
     /*
      * Root obj to prevent it from being collected out from under this call to
      * js_NewObject. There's a possibilty of GC under the objectHook call-out

js/src/xpconnect/loader/mozJSComponentLoader.cpp

@@ -74,7 +74,6 @@
 #include "nsIFileURL.h"
 #include "nsNetUtil.h"
 #endif
-#include "jsdbgapi.h"
 #include "jsxdrapi.h"
 #include "jsprf.h"
 #include "nsIFastLoadFileControl.h"
@@ -510,8 +509,6 @@ mozJSComponentLoader::ReallyInit()
     if (!mContext)
         return NS_ERROR_OUT_OF_MEMORY;
 
-    JS_FlagSystemContext(mContext);
-
     uint32 options = JS_GetOptions(mContext);
     JS_SetOptions(mContext, options | JSOPTION_XML);
 

js/src/xpconnect/src/nsXPConnect.cpp

@@ -982,9 +982,8 @@ nsXPConnect::InitClassesWithNewWrappedGlobal(JSContext * aJSContext,
        !JS_SetPrototype(aJSContext, tempGlobal, nsnull))
         return UnexpectedFailure(NS_ERROR_FAILURE);
 
-    NS_ASSERTION(!(aFlags & nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT) ||
-                 JS_IsSystemObject(aJSContext, tempGlobal),
-                 "system flag mismatch");
+    if(aFlags & nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT)
+        JS_FlagSystemObject(aJSContext, tempGlobal);
 
     nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
     {

js/src/xpconnect/src/xpcwrappednative.cpp

@@ -871,6 +871,10 @@ XPCWrappedNative::Init(XPCCallContext& ccx, JSObject* parent, JSBool isGlobal,
         return JS_FALSE;
     }
 
+    // Propagate the system flag from parent to child.
+    if(JS_IsSystemObject(ccx, parent))
+        JS_FlagSystemObject(ccx, mFlatJSObject);
+
     // This reference will be released when mFlatJSObject is finalized.
     // Since this reference will push the refcount to 2 it will also root
     // mFlatJSObject;
@@ -1717,6 +1721,10 @@ XPCWrappedNative::InitTearOffJSObject(XPCCallContext& ccx,
     if(!obj || !JS_SetPrivate(ccx, obj, to))
         return JS_FALSE;
 
+    // Propagate the system flag from parent to child.
+    if(JS_IsSystemObject(ccx, mFlatJSObject))
+        JS_FlagSystemObject(ccx, obj);
+
     to->SetJSObject(obj);
     return JS_TRUE;
 }

js/src/xpconnect/src/xpcwrappednativeproto.cpp

@@ -112,6 +112,10 @@ XPCWrappedNativeProto::Init(
 
     JSBool ok = mJSProtoObject && JS_SetPrivate(ccx, mJSProtoObject, this);
 
+    // Propagate the system flag from parent to child.
+    if(ok && JS_IsSystemObject(ccx, parent))
+        JS_FlagSystemObject(ccx, mJSProtoObject);
+
     DEBUG_ReportShadowedMembers(mSet, nsnull, this);
 
     return ok;