[turbofan] Fix deoptimization from array literal spread.

test/mjsunit/regress/regress-deopt-in-array-literal-spread.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
-function g(a, b, c) {
-  return a + b + c;
-}
+function f(a,b,c,d) { return [a, ...(%DeoptimizeNow(), [b,c]), d]; }
 
-function f() {
-  return g(1, (%_DeoptimizeNow(), 2), 3);
-}
-
-f();
-f();
+assertEquals([1,2,3,4], f(1,2,3,4));
+assertEquals([1,2,3,4], f(1,2,3,4));
 %OptimizeFunctionOnNextCall(f);
-assertEquals(6, f());
+assertEquals([1,2,3,4], f(1,2,3,4));