Bug 1333796 - Set descriptor value as undefined in XrayResolveAttribute. r=evilpie

When property getter is specified the desc's value must the set to undefined --
the desc can be re-used by a caller, so it must be done to preserve this
PropertyDescriptor invariant. We also do this in NativeGetOwnPropertyDescriptor.

MozReview-Commit-ID: 39MCwplbzL3

--HG--
extra : rebase_source : c39e3c6808bed3bcb8a1aa9a8194a89e58338a55

dom/bindings/BindingUtils.cpp

@@ -1338,6 +1338,7 @@ XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
             desc.setSetter(nullptr);
           }
           desc.object().set(wrapper);
+          desc.value().setUndefined();
           return true;
         }
       }