Fix ArrayShift hydrogen support

test/mjsunit/regress/regress-crbug-374838.js

Index: test/mjsunit/regress/regress-crbug-374838.js
diff --git a/test/mjsunit/regress/regress-361608.js b/test/mjsunit/regress/regress-crbug-374838.js
similarity index 57%
copy from test/mjsunit/regress/regress-361608.js
copy to test/mjsunit/regress/regress-crbug-374838.js
index b3cc90cfd4b06afb3c7424758e23f91d685e3aa2..614b4d9a877fb3b52fe920c74e4ea8c1d19fad93 100644
--- a/test/mjsunit/regress/regress-361608.js
+++ b/test/mjsunit/regress/regress-crbug-374838.js
@@ -4,17 +4,17 @@
 
 // Flags: --allow-natives-syntax
 
-function f() {};
-int_array = [1];
-
 function foo() {
-  var x;
-  for (var i = -1; i < 0; i++) {
-    x = int_array[i + 1];
-    f(function() { x = i; });
+  var a = [0];
+  result = 0;
+  for (var i = 0; i < 4; i++) {
+    result += a.length;
+    a.shift();
   }
+  return result;
 }
 
-foo();
+assertEquals(1, foo());
+assertEquals(1, foo());
 %OptimizeFunctionOnNextCall(foo);
-foo();
+assertEquals(1, foo());