When copying properties between objects, instead of replacing them WebKit/JSC just adds it and thus allows for multiple properties with the same name.
Created attachment 6935 [details] test case with double properties.
Broken in the nightlies as well.
*** This bug has been marked as a duplicate of 6639 ***