REGRESSION: Object.getOwnPropertyDescriptor returns wrong property descriptors for builtin objects

console.log(JSON.stringify(Object.getOwnPropertyDescriptor(Function.prototype, 'toString')));

{"writable":true,"enumerable":false,"configurable":true}

{"writable":false,"enumerable":false,"configurable":false}

(function() {
    var funcToString = Function.prototype.toString;
    var funcLength = 'function'.length;
    Object.defineProperty(Function.prototype, 'toString', {
      value: function() {
          var ret = funcToString.call(this);
          if (this.name)
              ret = ret.slice(0, funcLength) + ' ' + this.name + ret.slice(funcLength);
          return ret;
      },
      writable: true,
      enumerable: false,
      configurable: true
    });
}())

function foo() {
}

console.log(foo.toString());