Fix empty push bug in Array.push

test/mjsunit/regress/regress-670981-array-push.js

Index: test/mjsunit/regress/regress-670981-array-push.js
diff --git a/test/mjsunit/regress/regress-670981-array-push.js b/test/mjsunit/regress/regress-670981-array-push.js
new file mode 100644
index 0000000000000000000000000000000000000000..c0afe7faca77d9727e03d895b968577833f8afea
--- /dev/null
+++ b/test/mjsunit/regress/regress-670981-array-push.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var array = [];
+array.length = .6e+7;
+array.push( );
+assertEquals(array.length, .6e+7);