Test that TypedArray methods don't read length

test/mjsunit/harmony/typedarrays-foreach.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-arrays --allow-natives-syntax
 
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
@@ skipping 120 matching lines @@
   assertThrows(function () { constructor.prototype.forEach.call({}, function (x) {}) }, TypeError);
   assertThrows(function () { constructor.prototype.forEach.call(0, function (x) {}) }, TypeError);
 
   // Method must be useable on instances of other typed arrays.
   for (var i = 0; i < typedArrayConstructors.length; i++) {
     count = 0;
     a = new typedArrayConstructors[i](4);
     constructor.prototype.forEach.call(a, function (x) { count++ });
     assertEquals(a.length, count);
   }
+
+  // Shadowing length doesn't affect forEach, unlike Array.prototype.forEach
+  a = new constructor([1, 2]);
+  Object.defineProperty(a, 'length', {value: 1});
+  var x = 0;
+  assertEquals(a.forEach(function(elt) { x += elt; }), undefined);
+  assertEquals(x, 3);
+  assertEquals(Array.prototype.forEach.call(a,
+      function(elt) { x += elt; }), undefined);
+  assertEquals(x, 4);
 }
 
 for (i = 0; i < typedArrayConstructors.length; i++) {
   TestTypedArrayForEach(typedArrayConstructors[i]);
 }