Add test case demonstrating bug in SparseReverse when combined with getters/setters

BUG=v8:3612
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/628383002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24443 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

test/mjsunit/bugs/bug-3612.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [1];
+var getterValue = 2;
+var endIndex = 0xffff;
+Object.defineProperty(a, endIndex, {
+  get: function() {
+    this[1] = 3;
+    return getterValue;
+  },
+  set: function(val) {
+    getterValue = val;
+  },
+  configurable: true,
+  enumerable: true
+});
+a.reverse();
+assertFalse(a.hasOwnProperty(1));
+assertEquals(3, a[endIndex-1]);