Bug 560216 - Referring to an accessor property with undefined [[Get]] and [[Set]] fields using an unqualified name should not assert. r=dvander

js/src/jsinterp.cpp

@@ -3048,7 +3048,7 @@ END_CASE(JSOP_PICK)
 
 #define NATIVE_GET(cx,obj,pobj,shape,getHow,vp)                               \
     JS_BEGIN_MACRO                                                            \
-        if (shape->hasDefaultGetter()) {                                      \
+        if (shape->isDataDescriptor() && shape->hasDefaultGetter()) {         \
             /* Fast path for Object instance properties. */                   \
             JS_ASSERT((shape)->slot != SHAPE_INVALID_SLOT ||                  \
                       !shape->hasDefaultSetter());                            \

js/src/methodjit/StubCalls-inl.h

@@ -85,7 +85,7 @@ ReportAtomNotDefined(JSContext *cx, JSAtom *atom)
 
 #define NATIVE_GET(cx,obj,pobj,shape,getHow,vp,onerr)                         \
     JS_BEGIN_MACRO                                                            \
-        if (shape->hasDefaultGetter()) {                                      \
+        if (shape->isDataDescriptor() && shape->hasDefaultGetter()) {         \
             /* Fast path for Object instance properties. */                   \
             JS_ASSERT((shape)->slot != SHAPE_INVALID_SLOT ||                  \
                       !shape->hasDefaultSetter());                            \

js/src/tests/ecma_5/Object/jstests.list

@@ -37,3 +37,4 @@ skip-if(!xulRuntime.shell) script 15.2.3.6-dictionary-redefinition-7-of-8.js # u
 skip-if(!xulRuntime.shell) script 15.2.3.6-dictionary-redefinition-8-of-8.js # uses shell load() function
 script 15.2.3.6-define-over-method.js
 script mutation-prevention-methods.js
+script vacuous-accessor-unqualified-name.js

js/src/tests/ecma_5/Object/vacuous-accessor-unqualified-name.js

@@ -0,0 +1,26 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var gTestfile = 'vacuous-accessor-unqualified-name.js';
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 560216;
+var summary =
+  "Using a name referring to a { get: undefined, set: undefined } descriptor " +
+  "shouldn't assert";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+Object.defineProperty(this, "x", { set: undefined });
+x;
+
+/******************************************************************************/
+
+reportCompare(true, true);
+
+print("All tests passed!");