jscript: Use the object containing the prop for builtin getters.

dlls/jscript/dispex.c

@@ -454,7 +454,7 @@ static HRESULT prop_get(jsdisp_t *This, IDispatch *jsthis, dispex_prop_t *prop,
 
     switch(prop->type) {
     case PROP_BUILTIN:
-        hres = prop->u.p->getter(This->ctx, This, r);
+        hres = prop->u.p->getter(This->ctx, prop_obj, r);
         break;
     case PROP_JSVAL:
         hres = jsval_copy(prop->u.val, r);

dlls/mshtml/tests/es5.js

@@ -1720,6 +1720,9 @@ sync_test("builtin_context", function() {
     ok(obj === window, "obj = " + obj);
     obj = (function() { return this; }).call(42);
     ok(obj.valueOf() === 42, "obj = " + obj);
+
+    obj = Object.create([100]);
+    ok(obj.length === 1, "obj.length = " + obj.length);
 });
 
 sync_test("host this", function() {