[turbofan] Add inlined Array.prototype.pop support.

test/mjsunit/compiler/inlined-array-pop-getter1.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 function foo(a) {
-  for (var d in a) {
-    delete a[1];
-  }
+  return a.pop();
 }
 
-foo([1,2,3]);
-foo([2,3,4]);
+var a = new Array(4);
+
+assertEquals(undefined, foo(a));
+assertEquals(undefined, foo(a));
 %OptimizeFunctionOnNextCall(foo);
-foo([1,2,3]);
-assertOptimized(foo);
+assertEquals(undefined, foo(a));
+Object.prototype.__defineGetter__(0, function() { return 1; });
+assertEquals(1, foo(a));