These are currently ambiguous (and used inconsistently). It would logically appear that either being bit set implies that the corresponding type of accessor is present but (a) we don't correctly enforce this, and (b) this means the attributes would not be able to distinguish between a data descriptor and an accessor descriptor with neither a getter nor setter defined (which is a descriptor permissible under the spec). This ambiguity would lead to unsafe property caching behavior (though this does not represent an actual current bug, since we are currently unable to create descriptors that have neither a getter nor setter, it just prevents us from doing so).
Created attachment 122159 [details] Fix
Attachment 122159 [details] did not pass style-queue: Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'Source/JavaScriptCore/ChangeLog', u'Source..." exit_code: 1 Source/JavaScriptCore/runtime/JSObject.h:69: One space before end of line comments [whitespace/comments] [5] Total errors found: 1 in 9 files If any of these errors are false positives, please file a bug against check-webkit-style.
Fixed in r104784
It caused an assertion on SL, GTK and Qt: ASSERTION FAILED: value.isGetterSetter() == !!(attributes & Accessor) ../../../../Source/JavaScriptCore/runtime/PropertyDescriptor.cpp(90) : void JSC::PropertyDescriptor::setDescriptor(JSC::JSValue, unsigned int)
(In reply to comment #4) > It caused an assertion on SL, GTK and Qt: > > ASSERTION FAILED: value.isGetterSetter() == !!(attributes & Accessor) > ../../../../Source/JavaScriptCore/runtime/PropertyDescriptor.cpp(90) : void JSC::PropertyDescriptor::setDescriptor(JSC::JSValue, unsigned int) I forgot to mention the name of the test: fast/dom/getter-on-window-object2.html
Sorry I missed this ossy, investigating.
Created attachment 122325 [details] Fix
Fixed the layout test in r104871