2016-02-18  Chris Dumez  <cdumez@apple.com>

        Crash on SES selftest page when loading the page while WebInspector is open

        https://bugs.webkit.org/show_bug.cgi?id=154378

        <rdar://problem/24713422>

        Reviewed by NOBODY (OOPS!).

        Do a partial revert of r196676 so that JSObject::getOwnPropertyDescriptor()

        returns early again if it detects that getOwnPropertySlot() returns a

        non-own property. This check was removed in r196676 because we assumed that

        only JSDOMWindow::getOwnPropertySlot() could return non-own properties.

        However, as it turns out, DebuggerScope::getOwnPropertySlot() does so as

        well.

        Not having the check would lead to crashes when using the debugger because

        we would get a slot with the CustomAccessor attribute but getDirect() would

        then fail to return the property (because it is not an own property). We

        would then cast the value returned by getDirect() to a CustomGetterSetter*

        and dereference it.

        * runtime/JSObject.cpp:

        (JSC::JSObject::getOwnPropertyDescriptor):

    // DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain

    // but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that

    // the property is not an own property.

    if (slot.slotBase() != this && slot.slotBase()) {

        auto* proxy = jsDynamicCast<JSProxy*>(this);

        if (!proxy || proxy->target() != slot.slotBase())

            return false;

    }