Merged: [turbofan] Fix return value of Array.prototype.push.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 15bc6dfba24becd2388b947c295f72ebc44ad7bd..a5c6bab9692c956369a02b92e401121bdb7db6ba 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1374,6 +1374,8 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
         case kArrayIndexOf:
         case kArrayLastIndexOf:
           return Type::Range(-1, kMaxSafeInteger, t->zone());
+        case kArrayPush:
+          return t->cache_.kPositiveSafeInteger;
         // Object functions.
         case kObjectHasOwnProperty:
           return Type::Boolean();