Add test case demonstrating bug in SparseReverse when combined with getters/setters

test/mjsunit/bugs/bug-3612.js

Index: test/mjsunit/bugs/bug-3612.js
diff --git a/test/mjsunit/bugs/bug-3612.js b/test/mjsunit/bugs/bug-3612.js
new file mode 100644
index 0000000000000000000000000000000000000000..8c30ebf8ab5d5bda0023d1c275a46e55dd77983a
--- /dev/null
+++ b/test/mjsunit/bugs/bug-3612.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [1];
+var getterValue = 2;
+var endIndex = 0xffff;
+Object.defineProperty(a, endIndex, {
+  get: function() {
+    this[1] = 3;
+    return getterValue;
+  },
+  set: function(val) {
+    getterValue = val;
+  },
+  configurable: true,
+  enumerable: true
+});
+a.reverse();
+assertFalse(a.hasOwnProperty(1));
+assertEquals(3, a[endIndex-1]);