Don't inline Array.shift() if receiver map is not extensible.

test/mjsunit/regress/regress-crbug-405517.js

Index: test/mjsunit/regress/regress-crbug-405517.js
diff --git a/test/mjsunit/regress/regress-crbug-387636.js b/test/mjsunit/regress/regress-crbug-405517.js
similarity index 64%
copy from test/mjsunit/regress/regress-crbug-387636.js
copy to test/mjsunit/regress/regress-crbug-405517.js
index 1e50ace45a293c8561042f1a09c8fcd505b43dc2..36c3f4f7f7053d8ecaad77046d1c61f9594e302b 100644
--- a/test/mjsunit/regress/regress-crbug-387636.js
+++ b/test/mjsunit/regress/regress-crbug-405517.js
@@ -2,10 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --gc-interval=203
 
 function f() {
-  [].indexOf(0x40000000);
+ var e = [0];
+ %PreventExtensions(e);
+ for (var i = 0; i < 4; i++) e.shift();
 }
 
 f();