Do not inline array push for arrays with dictionary mode elements.

test/mjsunit/array-push12.js

Index: test/mjsunit/array-push12.js
diff --git a/test/mjsunit/compiler/regress-ntl-effect.js b/test/mjsunit/array-push12.js
similarity index 63%
copy from test/mjsunit/compiler/regress-ntl-effect.js
copy to test/mjsunit/array-push12.js
index 708fe32828c9197dfa3d8c371ab01cbc1ad3317a..f4c15b484b41197c9007113ecf8f91fe909cc5d3 100644
--- a/test/mjsunit/compiler/regress-ntl-effect.js
+++ b/test/mjsunit/array-push12.js
@@ -4,13 +4,20 @@
 
 // Flags: --allow-natives-syntax
 
+var a = [];
+for (var i = -20; i < 0; ++i) {
+  a[i] = 0;
+}
+
 function g() {
-  throw 0;
+    [].push.apply(a, arguments);
 }
 
 function f() {
   g();
-  while (1) {}
 }
 
-assertThrows(function () { f(); });
+g();
+g();
+%OptimizeFunctionOnNextCall(f);
+f();