Fix ArrayShift hydrogen support

BUG=chromium:374838
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/299713003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@21401 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-instructions.h

@@ -7123,6 +7123,7 @@ class HArrayShift V8_FINAL : public HTemplateInstruction<2> {
       : kind_(kind) {
     SetOperandAt(0, context);
     SetOperandAt(1, object);
+    SetChangesFlag(kArrayLengths);
     SetChangesFlag(kNewSpacePromotion);
     set_representation(Representation::Tagged());
     if (IsFastSmiOrObjectElementsKind(kind)) {

src/hydrogen.cc

@@ -7927,10 +7927,6 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
       return true;
     }
     case kArrayShift: {
-      // Something in here seems to be causing crbug.com/374838.
-      // TODO(bmeurer): Investigate the problem and re-enable this code.
-      return false;
-
       if (receiver_map.is_null()) return false;
       if (receiver_map->instance_type() != JS_ARRAY_TYPE) return false;
       ElementsKind kind = receiver_map->elements_kind();

test/mjsunit/regress/regress-crbug-374838.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var a = [0];
+  result = 0;
+  for (var i = 0; i < 4; i++) {
+    result += a.length;
+    a.shift();
+  }
+  return result;
+}
+
+assertEquals(1, foo());
+assertEquals(1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo());