Merged: [turbofan] Fix return value of Array.prototype.push.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 6733bd6affeb0592d93cc2b3c607da885f4dae4b..0d07053dedd0a732cfa3925bd4d229dca1b6706f 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -1352,6 +1352,8 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
         case kArrayIndexOf:
         case kArrayLastIndexOf:
           return Type::Range(-1, kMaxSafeInteger, t->zone());
+        case kArrayPush:
+          return t->cache_.kPositiveSafeInteger;
         // Object functions.
         case kObjectHasOwnProperty:
           return Type::Boolean();