Reland ArrayPop / ArrayPush.

test/mjsunit/array-pop.js

Index: test/mjsunit/array-pop.js
diff --git a/test/mjsunit/array-pop.js b/test/mjsunit/array-pop.js
index f193f09c2f7e0c3563687809b1ac09a2a3787080..17771839abc7ec29c0010133b289b9bbc06935b9 100644
--- a/test/mjsunit/array-pop.js
+++ b/test/mjsunit/array-pop.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+//
 // Check pops with various number of arguments.
 (function() {
   var a = [];
@@ -121,3 +123,18 @@
     assertEquals(99 - i, x.pop(), i + 'th iteration');
   }
 })();
+
+(function () {
+  function f(a, deopt) {
+    var v = a.pop() ? 1 : 2;
+    if (deopt) %DeoptimizeFunction(f);
+    return v;
+  }
+
+  var a = [true, true, true, true]
+  assertEquals(1, f(a, false));
+  assertEquals(1, f(a, false));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(1, f(a, false));
+  assertEquals(1, f(a, true));
+})();