Do not inline array push for arrays with dictionary mode elements.

src/hydrogen.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HYDROGEN_H_
 #define V8_HYDROGEN_H_
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
@@ skipping 2373 matching lines @@
                           BailoutId ast_id);
   bool TryInlineApiSetter(Handle<JSFunction> function,
                           Handle<Map> receiver_map,
                           BailoutId ast_id);
   bool TryInlineApiCall(Handle<JSFunction> function,
                          HValue* receiver,
                          SmallMapList* receiver_maps,
                          int argc,
                          BailoutId ast_id,
                          ApiCallType call_type);
+  static bool CanInlineArrayResizeOperation(Handle<Map> receiver_map);
 
   // If --trace-inlining, print a line of the inlining trace.  Inlining
   // succeeded if the reason string is NULL and failed if there is a
   // non-NULL reason string.
   void TraceInline(Handle<JSFunction> target,
                    Handle<JSFunction> caller,
                    const char* failure_reason);
 
   void HandleGlobalVariableAssignment(Variable* var,
                                       HValue* value,
@@ skipping 544 matching lines @@
   }
 
  private:
   HGraphBuilder* builder_;
 };
 
 
 } }  // namespace v8::internal
 
 #endif  // V8_HYDROGEN_H_