Xray wrappers don't cache resolved native properties on the holder object (bug 633382, r=mrbkap, a=blocker).

js/src/xpconnect/wrappers/XrayWrapper.cpp

@@ -442,13 +442,18 @@ XrayWrapper<Base>::resolveOwnProperty(JSContext *cx, JSObject *wrapper, jsid id,
     JSObject *holder = GetHolder(wrapper);
     JSObject *expando = GetExpandoObject(holder);
     if (expando) {
-        if (!JS_GetPropertyDescriptorById(cx, expando, id,
-                                          (set ? JSRESOLVE_ASSIGNING : 0) | JSRESOLVE_QUALIFIED,
-                                          desc)) {
+        if (!JS_GetPropertyDescriptorById(cx, expando, id, 0, desc)) {
             return false;
         }
+        if (desc->obj) {
+            return true;
+        }
+    }
 
-        if (desc->obj)
+    if (!JS_GetPropertyDescriptorById(cx, holder, id, 0, desc)) {
+        return false;
+    }
+    if (desc->obj) {
         return true;
     }