[turbofan] Fix return value of Array.prototype.push.

test/mjsunit/regress/regress-crbug-656037.js

Index: test/mjsunit/regress/regress-crbug-656037.js
diff --git a/test/mjsunit/regress/regress-5357.js b/test/mjsunit/regress/regress-crbug-656037.js
similarity index 70%
copy from test/mjsunit/regress/regress-5357.js
copy to test/mjsunit/regress/regress-crbug-656037.js
index 11ada60708fb233d7f02b707e7e9037611b0ec8b..47d09aaa4b9d466574eea9c5ecbd3c5af54cf911 100644
--- a/test/mjsunit/regress/regress-5357.js
+++ b/test/mjsunit/regress/regress-crbug-656037.js
@@ -5,13 +5,11 @@
 // Flags: --allow-natives-syntax
 
 function foo(a) {
-  a++;
-  a = Math.max(0, a);
-  a++;
-  return a;
+  return a.push(true);
 }
 
-foo(0);
-foo(0);
+var a = [];
+assertEquals(1, foo(a));
+assertEquals(2, foo(a));
 %OptimizeFunctionOnNextCall(foo);
-assertEquals(2147483648, foo(2147483646));
+assertEquals(3, foo(a));