fix #593, only call removeAttribute when have the method

[JiaLiPassion]

Fix #593, the issue can be described as following case.

  var xhr = new XMLHttpRequest();
  console.log('property', xhr.onreadystatechange);

When first time try to get xhr.onreadystatechange, it will access patched getter, and because
canPatchPropertyDescriptor change the getter which always return true, so the logic will go to
this.removeAttribute part which is not correct (this.removeAttribute is only for DOMElement).

[JamesHenry]

Awesome! Just got bitten by this, rolling back to 0.6.x works until this patch gets released