Turn ArrayPush into a stub specialized on the elements kind and argc.

test/mjsunit/array-push.js

Index: test/mjsunit/array-push.js
diff --git a/test/mjsunit/array-push.js b/test/mjsunit/array-push.js
index 2a25a9cc9e31eaeab85273ce0a5f95f35533565f..c87fd128e4bd4a19ccf07d6fd293592283726d89 100644
--- a/test/mjsunit/array-push.js
+++ b/test/mjsunit/array-push.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 // Check pushes with various number of arguments.
 (function() {
   var a = [];
@@ -113,3 +115,34 @@
     assertEquals(i + 1, x.length, i + 'th iteration');
   }
 })();
+
+(function() {
+  function f(a, i) {
+    a.push(i);
+  }
+
+  var a = [1,2,3];
+  a.f = function() { return 10; }
+  f(a, 4);
+  f(a, 5);
+  f(a, 6);
+  f(a, 7);
+  f(a, {});
+  assertEquals(10, a.f());
+})();
+
+(function() {
+  function f(a, i) {
+    a.push(i);
+  }
+
+  var a = [1,2,3];
+  a.f = function() { return 10; }
+  f(a, 4);
+  f(a, 5);
+  f(a, 6);
+  %OptimizeFunctionOnNextCall(f);
+  f(a, 7);
+  f(a, {});
+  assertEquals(10, a.f());
+})();