Fix deoptimization problem with inlined Array.push()

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 843be65710acfbefdd16144fde51eb49ea70b003..95e190ed1c3711035843abe52ba5d4b59ef7b062 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -7811,6 +7811,7 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
 
       HValue* value_to_push = Pop();
       HValue* array = Pop();
+      Drop(1);  // Drop function.
 
       HInstruction* new_size = NULL;
       HValue* length = NULL;
@@ -7832,7 +7833,6 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
         Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
       }
 
-      Drop(1);  // Drop function.
       ast_context()->ReturnValue(new_size);
       return true;
     }