Partially fix semantics of Array.push()

test/mjsunit/array-push2.js

Index: test/mjsunit/array-push2.js
diff --git a/test/mjsunit/array-push2.js b/test/mjsunit/array-push2.js
new file mode 100644
index 0000000000000000000000000000000000000000..fe4be4eb3e852bb0d7e6bc0f3c99fa2dea45870f
--- /dev/null
+++ b/test/mjsunit/array-push2.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var array = [];
+var v = 0;
+
+Object.defineProperty(Array.prototype, "0", {
+  get: function() { return "get " + v; },
+  set: function(value) { v += value; }
+});
+
+array[0] = 10;
+assertEquals(0, array.length);
+assertEquals(10, v);
+assertEquals("get 10", array[0]);
+
+array.push(100);
+assertEquals(1, array.length);
+assertEquals(110, v);
+assertEquals("get 110", array[0]);