Bug 560566 - "Assertion failure: getter" redefining property that's not the most recent property in an object whose scope is not in dictionary mode, when the original property was a half-accessor with an explicitly undefined absent half, and the new property is also an accessor and does not modify the explicitly undefined half of the original half-accessor. r=dmandelin

js/src/jsobj.cpp

@@ -2432,11 +2432,11 @@ DefinePropertyObject(JSContext *cx, JSObject *obj, const PropertyDescriptor &des
         if (desc.hasGet)
             getter = desc.getterObject() ? desc.getter() : JS_PropertyStub;
         else
-            getter = sprop->getter();
+            getter = sprop->hasDefaultGetter() ? JS_PropertyStub : sprop->getter();
         if (desc.hasSet)
             setter = desc.setterObject() ? desc.setter() : JS_PropertyStub;
         else
-            setter = sprop->setter();
+            setter = sprop->hasDefaultSetter() ? JS_PropertyStub : sprop->setter();
     }
 
     *rval = true;

js/src/jsscope.cpp

@@ -867,8 +867,6 @@ JSScope::putProperty(JSContext *cx, jsid id,
     CHECK_ANCESTOR_LINE(this, true);
 
     JS_ASSERT(!JSVAL_IS_NULL(id));
-    JS_ASSERT_IF(attrs & JSPROP_GETTER, getter);
-    JS_ASSERT_IF(attrs & JSPROP_SETTER, setter);
 
     JS_ASSERT_IF(!cx->runtime->gcRegenShapes,
                  hasRegenFlag(cx->runtime->gcRegenShapesScopeFlag));