[turbofan] Fix return value of Array.prototype.push.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 1431ff769ec6d5eaa42c93dc46e60b0d122a5457..ff5c3a10ce676a0f9fb32d0bffcadd8f817d5014 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1357,6 +1357,8 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
         case kArrayIndexOf:
         case kArrayLastIndexOf:
           return Type::Range(-1, kMaxSafeInteger, t->zone());
+        case kArrayPush:
+          return t->cache_.kPositiveSafeInteger;
         // Object functions.
         case kObjectHasOwnProperty:
           return Type::Boolean();