Bug 396758: the system flag is moved from GC flags to JSObject itself. r=brendan

js/src/jsapi.c

@@ -2754,8 +2754,7 @@ bad:
 JS_PUBLIC_API(JSClass *)
 JS_GetClass(JSContext *cx, JSObject *obj)
 {
-    return (JSClass *)
+    return GC_AWARE_GET_CLASS(cx, obj);
-        JSVAL_TO_PRIVATE(GC_AWARE_GET_SLOT(cx, obj, JSSLOT_CLASS));
 }
 #else
 JS_PUBLIC_API(JSClass *)

js/src/jsdbgapi.c

@@ -1643,16 +1643,21 @@ JS_FlagScriptFilenamePrefix(JSRuntime *rt, const char *prefix, uint32 flags)
 JS_PUBLIC_API(JSBool)
 JS_IsSystemObject(JSContext *cx, JSObject *obj)
 {
-    return (*js_GetGCThingFlags(obj) & GCF_SYSTEM) != 0;
+    return STOBJ_IS_SYSTEM(obj);
 }
 
 JS_PUBLIC_API(void)
 JS_FlagSystemObject(JSContext *cx, JSObject *obj)
 {
-    uint8 *flagp;
+    /*
-
+     * We do not need to lock the object here. This method is the only API
-    flagp = js_GetGCThingFlags(obj);
+     * that modifies JSSLOT_CLASS after the object is created and the slot is
-    *flagp |= GCF_SYSTEM;
+     * initialized with the object's class. Since we just set the system flag
+     * here and access to jsval is atomic, any thread that calls the method
+     * will end up writing the same (jsval)class_pointer | 3 value into the
+     * slot.
+     */
+    STOBJ_SET_SYSTEM(obj);
 }
 
 /************************************************************************/

js/src/jsgc.h

@@ -66,8 +66,7 @@ JS_BEGIN_EXTERN_C
 #define GCF_TYPEMASK    JS_BITMASK(GCX_NTYPES_LOG2)
 #define GCF_MARK        JS_BIT(GCX_NTYPES_LOG2)
 #define GCF_FINAL       JS_BIT(GCX_NTYPES_LOG2 + 1)
-#define GCF_SYSTEM      JS_BIT(GCX_NTYPES_LOG2 + 2)
+#define GCF_LOCKSHIFT   (GCX_NTYPES_LOG2 + 2)   /* lock bit shift */
-#define GCF_LOCKSHIFT   (GCX_NTYPES_LOG2 + 3)   /* lock bit shift */
 #define GCF_LOCK        JS_BIT(GCF_LOCKSHIFT)   /* lock request bit in API */
 
 extern JS_FRIEND_API(uint8 *)

js/src/jsobj.c

@@ -2472,10 +2472,17 @@ js_NewObject(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
     obj->map = NULL;
     obj->dslots = NULL;
 
-    /* Set the proto, parent, and class properties. */
+    /* Set the proto and parent properties. */
     STOBJ_SET_PROTO(obj, proto);
     STOBJ_SET_PARENT(obj, parent);
+
+    /*
+     * Set the class slot with the initial value of the system flag set to
+     * false.
+     */
+    JS_ASSERT(((jsuword) clasp & 3) == 0);
     STOBJ_SET_SLOT(obj, JSSLOT_CLASS, PRIVATE_TO_JSVAL(clasp));
+    JS_ASSERT(!STOBJ_IS_SYSTEM(obj));
 
     /* Initialize the remaining fixed slots. */
     for (i = JSSLOT_PRIVATE; i != JS_INITIAL_NSLOTS; ++i)

js/src/jsobj.h

@@ -164,10 +164,17 @@ struct JSObject {
 #define STOBJ_SET_PARENT(obj,parent) \
     ((obj)->fslots[JSSLOT_PARENT] = OBJECT_TO_JSVAL(parent))
 
-#define STOBJ_GET_CLASS(obj)                                                  \
+/*
-    ((JSClass *)JSVAL_TO_PRIVATE((obj)->fslots[JSSLOT_CLASS]))
+ * We use JSSLOT_CLASS to store both JSClass* and the system flag as an int-
+ * tagged value (see jsapi.h for details) with the system flag stored in the
+ * second lowest bit.
+ */
+#define STOBJ_GET_CLASS(obj)    ((JSClass *)((obj)->fslots[JSSLOT_CLASS] & ~3))
+#define STOBJ_IS_SYSTEM(obj)    (((obj)->fslots[JSSLOT_CLASS] & 2) != 0)
 
-#define STOBJ_GET_PRIVATE(obj)                                                \
+#define STOBJ_SET_SYSTEM(obj)   ((void)((obj)->fslots[JSSLOT_CLASS] |= 2))
+
+#define STOBJ_GET_PRIVATE(obj)                                          \
     (JS_ASSERT(JSVAL_IS_INT(STOBJ_GET_SLOT(obj, JSSLOT_PRIVATE))),            \
      JSVAL_TO_PRIVATE(STOBJ_GET_SLOT(obj, JSSLOT_PRIVATE)))