Check that array length stays a safe integer in Array.prototype.push

test/mjsunit/harmony/arraylike-push-limit.js

Index: test/mjsunit/harmony/arraylike-push-limit.js
diff --git a/test/message/destructuring-modify-const.js b/test/mjsunit/harmony/arraylike-push-limit.js
similarity index 56%
copy from test/message/destructuring-modify-const.js
copy to test/mjsunit/harmony/arraylike-push-limit.js
index cabd924b37ea9f178259f4c979c3b3268920c713..7df368f420c48a3658a3bc91888f8e897ab0f9e4 100644
--- a/test/message/destructuring-modify-const.js
+++ b/test/mjsunit/harmony/arraylike-push-limit.js
@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-destructuring
-'use strict';
+// Flags: --harmony-tolength
 
-const { x : x, y : y } = { x : 1, y : 2 };
-x++;
+var x = {length: Math.pow(2, 53) - 1};
+assertThrows(() => Array.prototype.push.call(x, 1), TypeError);