Implement Array.observe and emit splice change records for ArrayPush

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index 54f0b486e29a722a86a649d21666122b455e2d88..599fd5cfe98e97e484926ed697966041cb464561 100644
--- a/src/array.js
+++ b/src/array.js
@@ -416,6 +416,26 @@ function ArrayPop() {
 }
 
 
+function ObservedArrayPush() {
+  var n = TO_UINT32(this.length);
+  var m = %_ArgumentsLength();
+
+  EnqueueSpliceRecord(this, n, [], 0, m);
+
+  try {
+    BeginPerformSplice(this);
+
+    for (var i = 0; i < m; i++) {
+      this[i+n] = %_Arguments(i);
+    }
+    this.length = n + m;
+  } finally {
+    EndPerformSplice(this);
+  }
+
+  return this.length;
+}
+
 // Appends the arguments to the end of the array and returns the new
 // length of the array. See ECMA-262, section 15.4.4.7.
 function ArrayPush() {
@@ -424,6 +444,9 @@ function ArrayPush() {
                         ["Array.prototype.push"]);
   }
 
+  if (%IsObserved(this))
+    return ObservedArrayPush.apply(this, arguments);
+
   var n = TO_UINT32(this.length);
   var m = %_ArgumentsLength();
   for (var i = 0; i < m; i++) {