Check that the Accessor attribute is set in JSObject::getOwnNonIndexP…

…ropertySlot

https://bugs.webkit.org/show_bug.cgi?id=273576
rdar://127365044

Reviewed by Yusuke Suzuki.

We can't put in RELEASE_ASSERTs here since that would cause a nontrivial
perf hit on certain platforms, but we can at least put in debug asserts
to help with debugging.

* Source/JavaScriptCore/runtime/JSObject.h:
(JSC::JSObject::getOwnNonIndexPropertySlot):

Canonical link: https://commits.webkit.org/278518@main

Source/JavaScriptCore/runtime/JSObject.h

@@ -1514,9 +1514,11 @@ ALWAYS_INLINE bool JSObject::getOwnNonIndexPropertySlot(VM& vm, Structure* struc
         JSType type = cell->type();
         switch (type) {
         case GetterSetterType:
+            ASSERT(attributes & PropertyAttribute::Accessor);
             fillGetterPropertySlot(vm, slot, cell, attributes, offset);
             return true;
         case CustomGetterSetterType:
+            ASSERT(attributes & PropertyAttribute::CustomAccessorOrValue);
             fillCustomGetterPropertySlot(slot, jsCast<CustomGetterSetter*>(cell), attributes, structure);
             return true;
         default: