Clear foreach flag when running off the prototype chain of the object being enumerated (292020, r/a=me, thanks to jmsachs@gmail.com for the report).

js/src/jsinterp.c

@@ -2449,6 +2449,9 @@ js_Interpret(JSContext *cx, jsbytecode *pc, jsval *result)
                 if (!obj) {
                     /* End of property list -- terminate loop. */
                     rval = JSVAL_FALSE;
+#if JS_HAS_XML_SUPPORT
+                    foreach = JS_FALSE;
+#endif
                     goto end_forinloop;
                 }