fix #577, canPatchViaPropertyDescriptor test break XHR prototype

[JiaLiPassion]

fix #577, canPatchViaPropertyDescriptor test should add configurable to XMLHttpRequest.prototype.onreadystatechange, otherwise in opera 12, by default
XMLHttpRequest.prototype.onreadystatechange,

so after test below.

Object.defineProperty(XMLHttpRequest.prototype, 'onreadystatechange', {
    get: function() {
      return true;
    }
});

XMLHttpRequest.prototype.onreadystatechange become non-configurable.