SimpleMove now calls [[Has]] before [[Get]] when moving elements

test/mjsunit/regress/regress-3643.js

Index: test/mjsunit/regress/regress-3643.js
diff --git a/test/mjsunit/regress/regress-3643.js b/test/mjsunit/regress/regress-3643.js
index cc61a1c68ec5628674b97a469162aef85d40dec4..bbc94fd73b9905445c465c43709568b6a68b8367 100644
--- a/test/mjsunit/regress/regress-3643.js
+++ b/test/mjsunit/regress/regress-3643.js
@@ -2,20 +2,29 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var a = [1, 2, 3];
-Object.defineProperty(a, '1', {
-  get: function() { delete this[1]; return undefined; },
-  configurable: true
-});
+function newArrayWithGetter() {
+  var arr = [1, 2, 3];
+  Object.defineProperty(arr, '1', {
+    get: function() { delete this[1]; return undefined; },
+    configurable: true
+  });
+  return arr;
+}
+
+var a = newArrayWithGetter();
 var s = a.slice(1);
 assertTrue('0' in s);
 
 // Sparse case should hit the same code as above due to presence of the getter.
-a = [1, 2, 3];
+a = newArrayWithGetter();
 a[0xffff] = 4;
-Object.defineProperty(a, '1', {
-  get: function() { delete this[1]; return undefined; },
-  configurable: true
-});
 s = a.slice(1);
 assertTrue('0' in s);
+
+a = newArrayWithGetter();
+a.shift();
+assertTrue('0' in a);
+
+a = newArrayWithGetter();
+a.unshift(0);
+assertTrue('2' in a);