Hi everyone,

I found an inconsistency on JSC when we try to push a new element into an Object that uses Array.prototype.push method.
Seems like a conversion ToUint32 on JSC while the others engines exceed this value. 
In addiction, it was observed that JSC push the element in index 0 and index length-1.

OS: Ubuntu 16.04 x64
build version: 233840

Step to reproduce:
var o = { length : 2**32, push : Array.prototype.push };
print(o.push('A'));
print(o[0], o[o.length-1]);

Actual results:
1
A A

Expected results:
4294967297
undefined A

V8, SpiderMonkey, Chakra and XS works as expected.