DFG should inline Array.push and Array.pop