Use simple keyed store again in ArrayPush_JS_Builtin

This reverts the change of array.js in r20839 and recovers 38%
performance regression of DOM-Search case in Browsermark2.0. There is
no performance impact on JavaScript benchmarks (Octane, Kraken and
SunSpider).

BUG=
R=danno@chromium.org

Review URL: https://codereview.chromium.org/353953002

Patch from Weiliang Lin <weiliang.lin@intel.com>.

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@22080 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/array.js

@@ -443,9 +443,7 @@ function ArrayPush() {
   var m = %_ArgumentsLength();
 
   for (var i = 0; i < m; i++) {
-    // Use SetProperty rather than a direct keyed store to ensure that the store
-    // site doesn't become poisened with an elements transition KeyedStoreIC.
-    %SetProperty(array, i+n, %_Arguments(i), kStrictMode);
+    array[i+n] = %_Arguments(i);
   }
 
   var new_length = n + m;