deleted file mode 100644
--- a/js/src/jit-test/tests/basic/bug624041-1.js
+++ /dev/null
@@ -1,8 +0,0 @@
-var count = 0;
-
-var a = [0, 1];
-for (var i in a) {
-    assertEq(++count <= 1, true);
-    a.shift();
-}
-

deleted file mode 100644
--- a/js/src/jit-test/tests/basic/bug624041-2.js
+++ /dev/null
@@ -1,11 +0,0 @@
-var s = '';
-
-var a = [, 0, 1];
-for (var i in a) {
-    a.reverse();
-    s += i + ',';
-}
-
-// Index of the element with value '0'.
-assertEq(s, '1,');
-

--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -1479,25 +1479,20 @@ array_reverse(JSContext *cx, uintN argc,
             if (result == JSObject::ED_FAILED)
                 return false;
             JS_ASSERT(result == JSObject::ED_SPARSE);
             break;
         }
 
         uint32 lo = 0, hi = len - 1;
         for (; lo < hi; lo++, hi--) {
-            Value origlo = obj->getDenseArrayElement(lo);
-            Value orighi = obj->getDenseArrayElement(hi);
-            obj->setDenseArrayElement(lo, orighi);
-            if (orighi.isMagic(JS_ARRAY_HOLE))
-                js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(lo));
-            obj->setDenseArrayElement(hi, origlo);
-            if (origlo.isMagic(JS_ARRAY_HOLE))
-                js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(hi));
-            }
+            Value tmp = obj->getDenseArrayElement(lo);
+            obj->setDenseArrayElement(lo, obj->getDenseArrayElement(hi));
+            obj->setDenseArrayElement(hi, tmp);
+        }
 
         /*
          * Per ECMA-262, don't update the length of the array, even if the new
          * array has trailing holes (and thus the original array began with
          * holes).
          */
         return JS_TRUE;
     } while (false);
@@ -2156,18 +2151,16 @@ array_shift(JSContext *cx, uintN argc, V
             length < obj->getDenseArrayCapacity()) {
             *vp = obj->getDenseArrayElement(0);
             if (vp->isMagic(JS_ARRAY_HOLE))
                 vp->setUndefined();
             Value *elems = obj->getDenseArrayElements();
             memmove(elems, elems + 1, length * sizeof(jsval));
             obj->setDenseArrayElement(length, MagicValue(JS_ARRAY_HOLE));
             obj->setArrayLength(length);
-            if (!js_SuppressDeletedProperty(cx, obj, INT_TO_JSID(length)));
-                return JS_FALSE;
             return JS_TRUE;
         }
 
         /* Get the to-be-deleted property's value into vp ASAP. */
         if (!GetElement(cx, obj, 0, &hole, vp))
             return JS_FALSE;
 
         /* Slide down the array above the first element. */