perf(array): add dense fast path to Array.prototype.push

Array.prototype.push was going through the generic [[Set]] machinery
for every element, which involves property descriptor validation and
prototype chain walks. This is unnecessary for dense arrays where we
can append directly to the indexed storage.

Add a fast path that mirrors the PushValueToArray opcode: check that
the array is extensible and has dense storage, then push directly via
push_dense() and update the length in-place. Falls through to the
existing slow path for sparse arrays, non-extensible arrays, and
array-like objects.

~49% improvement on a push-dominated microbenchmark, ~20% on a
realistic mixed workload (push objects + filter).

Author: tkshsbcue

core/engine/src/builtins/array/mod.rs

@@ -875,6 +875,35 @@ impl Array {
                 )
                 .into());
         }
+
+        // Fast path: if O is an extensible dense array, push directly to indexed
+        // storage without going through the generic [[Set]] machinery. push_dense()
+        // handles type transitions (DenseI32 -> DenseF64 -> DenseElement) and
+        // only returns false for already-sparse storage, so if the first push
+        // succeeds all subsequent pushes on the same storage will too.
+        if o.is_array() && !args.is_empty() {
+            let mut o_borrowed = o.borrow_mut();
+            if o_borrowed.extensible
+                && let Some(len_i32) = o_borrowed.properties().storage[0].as_i32()
+                && o_borrowed
+                    .properties_mut()
+                    .indexed_properties
+                    .push_dense(&args[0])
+            {
+                let mut current_len = len_i32 + 1;
+                for element in &args[1..] {
+                    o_borrowed
+                        .properties_mut()
+                        .indexed_properties
+                        .push_dense(element);
+                    current_len += 1;
+                }
+                o_borrowed.properties_mut().storage[0] = JsValue::new(current_len);
+                len += args.len() as u64;
+                return Ok(len.into());
+            }
+        }
+
         // 5. For each element E of items, do
         for element in args.iter().cloned() {
             // a. Perform ? Set(O, ! ToString(𝔽(len)), E, true).