Backed out changeset 1732da7b3164
authorAndreas Gal <gal@mozilla.com>
Mon, 15 Mar 2010 16:13:49 -0700
changeset 40268 92d2267a21178652d95be3822f3610721a3d7399
parent 40266 1732da7b3164a646aed33b81a2bc515211fc7b4d
child 40269 4787abf9f39bd829593e1a308ba1bdae7971612b
push id12610
push userrsayre@mozilla.com
push dateMon, 05 Apr 2010 17:26:41 +0000
treeherdermozilla-central@1942c0b4e101 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.3a3pre
backs out1732da7b3164a646aed33b81a2bc515211fc7b4d
Backed out changeset 1732da7b3164
js/src/jsinterp.cpp
js/src/jsobj.cpp
js/src/jsobj.h
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -344,16 +344,22 @@ js_FillPropertyCache(JSContext *cx, JSOb
             PCMETER(if (PCVCAP_TAG(cache->table[khash].vcap) <= 1)
                         cache->pcrecycles++);
             pc = (jsbytecode *) atom;
             kshape = (jsuword) obj;
 
             /*
              * Make sure that a later shadowing assignment will enter
              * PurgeProtoChain and invalidate this entry, bug 479198.
+             *
+             * This is thread-safe even though obj is not locked. Only the
+             * DELEGATE bit of obj->classword can change at runtime, given that
+             * obj is native; and the bit is only set, never cleared. And on
+             * platforms where another CPU can fail to see this write, it's OK
+             * because the property cache and JIT cache are thread-local.
              */
             obj->setDelegate();
         }
     }
     JS_ASSERT(vshape < SHAPE_OVERFLOW_BIT);
 
     entry = &cache->table[khash];
     PCMETER(PCVAL_IS_NULL(entry->vword) || cache->recycles++);
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -6740,44 +6740,16 @@ bool
 JSObject::isCallable()
 {
     if (isNative())
         return isFunction() || getClass()->call;
 
     return !!map->ops->call;
 }
 
-void
-JSObject::setClass(const JSClass *clasp)
-{
-    JS_ASSERT((jsuword(clasp) & 3) == 0);
-    jsuword ov, nv;
-
-    do {
-        ov = classword;
-        nv = jsuword(clasp) | (ov & 3);
-    } while (!js_CompareAndSwap((jsword *)&classword, ov, nv));
-}
-
-void
-JSObject::setDelegate()
-{
-    if (classword & jsuword(1))
-        return;
-    JS_ATOMIC_SET_MASK(&classword, 1);
-}
-
-void
-JSObject::setSystem()
-{
-    if (classword & jsuword(2))
-        return;
-    JS_ATOMIC_SET_MASK(&classword, 2);
-}
-
 JSBool
 js_ReportGetterOnlyAssignment(JSContext *cx)
 {
     return JS_ReportErrorFlagsAndNumber(cx,
                                         JSREPORT_WARNING | JSREPORT_STRICT |
                                         JSREPORT_STRICT_MODE_ERROR,
                                         js_GetErrorMessage, NULL,
                                         JSMSG_GETTER_ONLY);
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -258,34 +258,36 @@ struct JSObject {
     JSClass *getClass() const {
         return (JSClass *) (classword & ~JSSLOT_CLASS_MASK_BITS);
     }
 
     bool hasClass(const JSClass *clasp) const {
         return clasp == getClass();
     }
 
-    void setClass(const JSClass *clasp);
-
     bool isDelegate() const {
         return (classword & jsuword(1)) != jsuword(0);
     }
 
-    void setDelegate();
+    void setDelegate() {
+        classword |= jsuword(1);
+    }
 
     static void setDelegateNullSafe(JSObject *obj) {
         if (obj)
             obj->setDelegate();
     }
 
     bool isSystem() const {
         return (classword & jsuword(2)) != jsuword(0);
     }
 
-    void setSystem();
+    void setSystem() {
+        classword |= jsuword(2);
+    }
 
     JSObject *getProto() const {
         return JSVAL_TO_OBJECT(fslots[JSSLOT_PROTO]);
     }
 
     void clearProto() {
         fslots[JSSLOT_PROTO] = JSVAL_NULL;
     }