ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter

ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
https://bugs.webkit.org/show_bug.cgi?id=181388
<rdar://problem/36349351>

Reviewed by Saam Barati.

JSTests:

* stress/regress-181388.js: Added.

Source/JavaScriptCore:

When there are duplicate setters or getters, we may end up overwriting a getter
with a setter, or vice versa.  This patch adds tracking for getters/setters that
have been overwritten with duplicates and ignore them.

* bytecompiler/NodesCodegen.cpp:
(JSC::PropertyListNode::emitBytecode):
* parser/NodeConstructors.h:
(JSC::PropertyNode::PropertyNode):
* parser/Nodes.h:
(JSC::PropertyNode::isOverriddenByDuplicate const):
(JSC::PropertyNode::setIsOverriddenByDuplicate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@226650 268f45cc-cd09-0410-ab3c-d52691b4dbfc