Partially fix semantics of Array.push()

src/string.js

Index: src/string.js
diff --git a/src/string.js b/src/string.js
index 74230c986411247d7d8f5dfdea869a1efff5c49e..83435584f2edac3216e0717e50c704fbddc62bb5 100644
--- a/src/string.js
+++ b/src/string.js
@@ -658,7 +658,7 @@ function StringSplitOnRegExp(subject, separator, limit, length) {
   var currentIndex = 0;
   var startIndex = 0;
   var startMatch = 0;
-  var result = [];
+  var result = new InternalArray();
 
   outer_loop:
   while (true) {
@@ -703,7 +703,9 @@ function StringSplitOnRegExp(subject, separator, limit, length) {
 
     startIndex = currentIndex = endIndex;
   }
-  return result;
+  var array_result = [];
+  %MoveArrayContents(result, array_result);
+  return array_result;
 }