Try to fix Ts regression (414452, r=shaver).

js/src/jsgc.c

@@ -2457,15 +2457,14 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
     if (rt->state != JSRTS_UP && gckind != GC_LAST_CONTEXT)
         return;
 
-  restart_after_callback:
+  restart_at_beginning:
     /*
      * Let the API user decide to defer a GC if it wants to (unless this
      * is the last context).  Invoke the callback regardless. Sample the
      * callback in case we are freely racing with a JS_SetGCCallback{,RT} on
      * another thread.
      */
-    callback = rt->gcCallback;
-    if (callback) {
+    if (gckind != GC_SET_SLOT_REQUEST && (callback = rt->gcCallback)) {
         JSBool ok;
 
         if (gckind & GC_LOCK_HELD)
@@ -2603,6 +2602,8 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
             goto done_running;
         rt->gcLevel = 1;
         rt->gcPoke = JS_FALSE;
+        gckind = GC_LOCK_HELD;
+        goto restart_at_beginning;
     }
 
     JS_UNLOCK_GC(rt);
@@ -2924,8 +2925,7 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
      * pointer in case it changes, since we are outside of the GC vs. requests
      * interlock mechanism here.
      */
-    callback = rt->gcCallback;
-    if (callback) {
+    if (gckind != GC_SET_SLOT_REQUEST && (callback = rt->gcCallback)) {
         JSWeakRoots savedWeakRoots;
         JSTempValueRooter tvr;
 
@@ -2952,7 +2952,7 @@ js_GC(JSContext *cx, JSGCInvocationKind gckind)
              * On shutdown iterate until JSGC_END callback stops creating
              * garbage.
              */
-            goto restart_after_callback;
+            goto restart_at_beginning;
         }
     }
 }

js/src/jsgc.h

@@ -247,20 +247,20 @@ typedef enum JSGCInvocationKind {
      * Currently, this flag is set for the invocation kinds that also preserve
      * atoms and weak roots, so we don't need another bit for GC_KEEP_ATOMS.
      */
-    GC_LOCK_HELD        = 2,
+    GC_LOCK_HELD        = 0x10,
     GC_KEEP_ATOMS       = GC_LOCK_HELD,
 
     /*
      * Called from js_SetProtoOrParent with a request to set an object's proto
      * or parent slot inserted on rt->setSlotRequests.
      */
-    GC_SET_SLOT_REQUEST = GC_LOCK_HELD | 0,
+    GC_SET_SLOT_REQUEST = GC_LOCK_HELD | 1,
 
     /*
      * Called from js_NewGCThing as a last-ditch GC attempt. See comments
      * in jsgc.c just before js_GC's definition for details.
      */
-    GC_LAST_DITCH       = GC_LOCK_HELD | 1
+    GC_LAST_DITCH       = GC_LOCK_HELD | 2
 } JSGCInvocationKind;
 
 extern void