Reverse order that spies are cleared up.

Fixes #1010

spec/core/SpyRegistrySpec.js

@@ -89,5 +89,24 @@ describe("SpyRegistry", function() {
 
       expect(subject.spiedFunc).toBe(originalFunction);
     });
+
+    it("restores the original functions, even when that spy has been replace and re-spied upon", function() {
+      var spies = [],
+        spyRegistry = new jasmineUnderTest.SpyRegistry({currentSpies: function() { return spies; }}),
+        originalFunction = function() {},
+        subject = { spiedFunc: originalFunction };
+
+      spyRegistry.spyOn(subject, 'spiedFunc');
+
+      // replace the original spy with some other function
+      subject.spiedFunc = function() {};
+
+      // spy on the function in that location again
+      spyRegistry.spyOn(subject, 'spiedFunc');
+
+      spyRegistry.clearSpies();
+
+      expect(subject.spiedFunc).toBe(originalFunction);
+    });
   });
 });

src/core/SpyRegistry.js

@@ -49,7 +49,7 @@ getJasmineRequireObj().SpyRegistry = function(j$) {
 
     this.clearSpies = function() {
       var spies = currentSpies();
-      for (var i = 0; i < spies.length; i++) {
+      for (var i = spies.length - 1; i >= 0; i--) {
         var spyEntry = spies[i];
         spyEntry.baseObj[spyEntry.methodName] = spyEntry.originalValue;
       }