Another bug 599009 followup. Don't assert things about uninitialized quantities.

js/src/jsinterp.cpp

@@ -5391,7 +5391,7 @@ BEGIN_CASE(JSOP_DEFFUN)
              * setter to an existing property without a getter or setter.
              */
             JS_ASSERT(!(attrs & ~(JSPROP_ENUMERATE|JSPROP_PERMANENT)));
-            JS_ASSERT(!(old & JSPROP_READONLY));
+            JS_ASSERT_IF(attrs != JSPROP_ENUMERATE, !(old & JSPROP_READONLY));
             doSet = true;
         }
         pobj->dropProperty(cx, prop);

js/src/methodjit/StubCalls.cpp

@@ -954,7 +954,7 @@ stubs::DefFun(VMFrame &f, JSFunction *fun)
              * setter to an existing property without a getter or setter.
              */
             JS_ASSERT(!(attrs & ~(JSPROP_ENUMERATE|JSPROP_PERMANENT)));
-            JS_ASSERT(!(old & JSPROP_READONLY));
+            JS_ASSERT_IF(attrs != JSPROP_ENUMERATE, !(old & JSPROP_READONLY));
             doSet = true;
         }
         pobj->dropProperty(cx, prop);