diff -r 000000000000 -r 6474c204b198 js/src/jit-test/tests/for-of/arrays-shrinking-1.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jit-test/tests/for-of/arrays-shrinking-1.js	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,13 @@
+// A for-of loop over an array stops at the new end of the array if it shrinks during iteration.
+
+function ispal(arr) {
+    for (var v of arr) {
+        if (v !== arr.pop())
+            return false;
+    }
+    return true;
+}
+
+assertEq(ispal([1, 2, 3, 4, 3, 2, 1]), true);
+assertEq(ispal([1, 2, 3, 3, 2, 1]), true);
+assertEq(ispal([1, 2, 3, 4, 2, 1]), false);