Merge

js/src/jsapi.cpp

@@ -3175,11 +3175,16 @@ GetPropertyAttributesById(JSContext *cx, JSObject *obj, jsid id, uintN flags,
         if (obj2->isNative()) {
             JSScopeProperty *sprop = (JSScopeProperty *) prop;
 
-            desc->getter = sprop->getter();
-            desc->setter = sprop->setter();
-            desc->value = SPROP_HAS_VALID_SLOT(sprop, obj2->scope())
-                          ? obj2->lockedGetSlot(sprop->slot)
-                          : JSVAL_VOID;
+            if (sprop->isMethod()) {
+                desc->getter = desc->setter = JS_PropertyStub;
+                desc->value = sprop->methodValue();
+            } else {
+                desc->getter = sprop->getter();
+                desc->setter = sprop->setter();
+                desc->value = SPROP_HAS_VALID_SLOT(sprop, obj2->scope())
+                              ? obj2->lockedGetSlot(sprop->slot)
+                              : JSVAL_VOID;
+            }
         } else {
             if (obj->isProxy()) {
                 JSAutoResolveFlags rf(cx, flags);

js/src/jsobj.cpp

@@ -2302,8 +2302,13 @@ DefinePropertyOnObject(JSContext *cx, JSObject *obj, const PropertyDescriptor &d
             changed |= JSPROP_ENUMERATE;
 
         attrs = (sprop->attributes() & ~changed) | (desc.attrs & changed);
-        getter = sprop->getter();
-        setter = sprop->setter();
+        if (sprop->isMethod()) {
+            JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
+            getter = setter = JS_PropertyStub;
+        } else {
+            getter = sprop->getter();
+            setter = sprop->setter();
+        }
     } else if (desc.isDataDescriptor()) {
         uintN unchanged = 0;
         if (!desc.hasConfigurable)
@@ -2343,10 +2348,11 @@ DefinePropertyOnObject(JSContext *cx, JSObject *obj, const PropertyDescriptor &d
             changed |= JSPROP_SETTER | JSPROP_SHARED;
 
         attrs = (desc.attrs & changed) | (sprop->attributes() & ~changed);
+        JS_ASSERT_IF(sprop->isMethod(), !(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
         if (desc.hasGet) {
             getter = desc.getter();
         } else {
-            getter = (sprop->hasDefaultGetter() && !sprop->hasGetterValue())
+            getter = (sprop->isMethod() || (sprop->hasDefaultGetter() && !sprop->hasGetterValue()))
                      ? JS_PropertyStub
                      : sprop->getter();
         }

js/src/tests/ecma_5/extensions/jstests.list

@@ -1,3 +1,4 @@
 url-prefix ../../jsreftest.html?test=ecma_5/extensions/
 script string-literal-getter-setter-decompilation.js
 script 8.12.5-01.js
+script regress-bug567606.js

js/src/tests/ecma_5/extensions/regress-bug567606.js

@@ -0,0 +1,17 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+(function() {
+    function f() {
+        this.b = function() {};
+        Object.defineProperty(this, "b", ({
+            configurable: __defineSetter__("", function() {})
+        }));
+    }
+    for each(y in [0]) {
+        _ = new f();
+    }
+})();
+uneval(this);
+
+reportCompare(true, true);