Fix ArrayShift hydrogen support

test/mjsunit/regress/regress-crbug-374838.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-function f() {};
-int_array = [1];
-
 function foo() {
-  var x;
-  for (var i = -1; i < 0; i++) {
-    x = int_array[i + 1];
-    f(function() { x = i; });
+  var a = [0];
+  result = 0;
+  for (var i = 0; i < 4; i++) {
+    result += a.length;
+    a.shift();
   }
+  return result;
 }
 
-foo();
+assertEquals(1, foo());
+assertEquals(1, foo());
 %OptimizeFunctionOnNextCall(foo);
-foo();
+assertEquals(1, foo());