Bug 26520

In the test case we extend the prototype of HTMLInputElement to add a property "foo". In the child iframe I extend the prototype of HTMLInputElement to add a property "bar". In the child iframe we hook up an event listener to the parent window's body and access e.target. When clicking the submit button we should expect to see "foo", which is the property we added to the HTMLInputElement's prototype, but instead we see "undefined". Removing the line in the iframe which accesses e.target causes the alert to display "foo", as expected. It looks like when e.target is accessed in the child iframe it creates the HTMLElement DOM wrapper and this causes the prototypes from the parent window to be moved to the child iframe, then when we handle the onsubmit event in the parent window it lazyilly creates the HTMLElement DOM wrapper but with a blank prototype that now exists in the parent window. The extended prototypes are getting incorrectly moved between the two window objects. This looks like it could be related to bug 24795 but the testcase attached to that bug seems to work in the latest nightly so I suspect that it could actually be a different issue.