fix(patch): patchOnProperty getter should return original listener

lib/common/utils.ts

@@ -170,8 +170,9 @@ export function patchProperty(obj: any, prop: string, prototype?: any) {
     if (!target) {
       return null;
     }
-    if (target[eventNameSymbol]) {
-      return wrapFn;
+    const listener = target[eventNameSymbol];
+    if (listener) {
+      return listener;
     } else if (originalDescGet) {
       // result will be null when use inline event attribute,
       // such as <button onclick="func();">OK</button>

test/browser/XMLHttpRequest.spec.ts

@@ -6,7 +6,7 @@
  * found in the LICENSE file at https://angular.io/license
  */
 
-import {ifEnvSupports, supportPatchXHROnProperty} from '../test-util';
+import {ifEnvSupports, ifEnvSupportsWithDone, supportPatchXHROnProperty} from '../test-util';
 
 describe('XMLHttpRequest', function() {
   let testZone: Zone;
@@ -280,4 +280,24 @@ describe('XMLHttpRequest', function() {
       req.send();
     });
   });
+
+  it('should return origin listener when call xhr.onreadystatechange',
+     ifEnvSupportsWithDone(supportPatchXHROnProperty, function(done: Function) {
+       testZone.run(function() {
+         // sometimes this case will cause timeout
+         // so we set it longer
+         const req = new XMLHttpRequest();
+         req.open('get', '/', true);
+         const listener = req.onreadystatechange = function() {
+           if (req.readyState === 4) {
+             done();
+           }
+         };
+         expect(req.onreadystatechange).toBe(listener);
+         req.onreadystatechange = function() {
+           return listener.apply(this, arguments);
+         };
+         req.send();
+       });
+     }));
 });