Merged: [turbofan] Fix return value of Array.prototype.push.

test/mjsunit/regress/regress-crbug-656037.js

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 function foo(a) {
-  for (var d in a) {
-    delete a[1];
-  }
+  return a.push(true);
 }
 
-foo([1,2,3]);
-foo([2,3,4]);
+var a = [];
+assertEquals(1, foo(a));
+assertEquals(2, foo(a));
 %OptimizeFunctionOnNextCall(foo);
-foo([1,2,3]);
-assertOptimized(foo);
+assertEquals(3, foo(a));