Use simple keyed store again in ArrayPush_JS_Builtin

src/array.js

Index: src/array.js
diff --git a/src/array.js b/src/array.js
index a16f430d116d31362819af77f3ea124bbd0bab96..e8f7c63c9a743817e65533165a483eacfd5c49c3 100644
--- a/src/array.js
+++ b/src/array.js
@@ -443,9 +443,7 @@ function ArrayPush() {
   var m = %_ArgumentsLength();
 
   for (var i = 0; i < m; i++) {
-    // Use SetProperty rather than a direct keyed store to ensure that the store
-    // site doesn't become poisened with an elements transition KeyedStoreIC.
-    %SetProperty(array, i+n, %_Arguments(i), 0, kStrictMode);
+    array[i+n] = %_Arguments(i);
   }
 
   var new_length = n + m;