Fix handling Function.apply for non-array arguments.

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 451 matching lines @@
   // multiplying with pointer size.
   if (length > 0x800000) {
     throw %MakeRangeError('stack_overflow', []);
   }
 
   if (!IS_SPEC_FUNCTION(this)) {
     throw %MakeTypeError('apply_non_function', [ %ToString(this), typeof this ]);
   }
 
   // Make sure the arguments list has the right type.
-  if (args != null && !IS_ARRAY(args) && !IS_ARGUMENTS(args)) {
+  if (args != null && !IS_SPEC_OBJECT(args)) {
     throw %MakeTypeError('apply_wrong_args', []);
   }
 
   // Return the length which is the number of arguments to copy to the
   // stack. It is guaranteed to be a small integer at this point.
   return length;
 }
 
 
 function APPLY_OVERFLOW(length) {
@@ skipping 181 matching lines @@
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 
 // NOTE: Setting the prototype for Array must take place as early as
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype($Array, new $Array(0));