Upgrade V8 to 5.1.281.57
Change-Id: Id981b686b4d587ac31697662eb98bb34be42ad90
diff --git a/test/mjsunit/array-foreach.js b/test/mjsunit/array-foreach.js
new file mode 100644
index 0000000..0e34c03
--- /dev/null
+++ b/test/mjsunit/array-foreach.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [20, 21, 22, 23];
+a.__proto__ = [10, 11, 12, 13];
+
+var values = [];
+var indices = [];
+function callback(value, index, object) {
+ object.length = 2;
+ values.push(value);
+ indices.push(index);
+}
+a.forEach(callback);
+assertEquals([20, 21, 12, 13], values);
+assertEquals([0, 1, 2, 3], indices);