[Builtins] Smi-check the spread and go to runtime in CheckSpreadAndPushToStack.

test/mjsunit/es6/spread-call.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function testSpreadCallsStrict() {
   "use strict"
   function countArgs() { return arguments.length; }
 
   // Test this argument
   function returnThis() { return this; }
@@ skipping 31 matching lines @@
 
   // Test values
   function sum() {
     var sum = arguments[0];
     for (var i = 1; i < arguments.length; ++i) {
       sum += arguments[i];
     }
     return sum;
   }
 
+  assertThrows(function() {
+    sum(...0);
+  }, TypeError);
   assertEquals(void 0, sum(...""));
   assertEquals(void 0, sum(...[]));
   assertEquals(void 0, sum(...new Set));
   assertEquals(void 0, sum(...(function*() { })()));
 
   assertEquals("test", sum(..."test"));
   assertEquals(10, sum(...[1, 2, 3, 4]));
   assertEquals(10, sum(...[1, 2, 3], 4));
   assertEquals(10, sum(1, ...[2, 3], 4));
   assertEquals(10, sum(1, ...[2, 3], ...[4]));
@@ skipping 132 matching lines @@
 
   // Test values
   function sum() {
     var sum = arguments[0];
     for (var i = 1; i < arguments.length; ++i) {
       sum += arguments[i];
     }
     return sum;
   }
 
+  assertThrows(function() {
+    sum(...0);
+  }, TypeError);
   assertEquals(void 0, sum(...""));
   assertEquals(void 0, sum(...[]));
   assertEquals(void 0, sum(...new Set));
   assertEquals(void 0, sum(...(function*() { })()));
 
   assertEquals("test", sum(..."test"));
   assertEquals(10, sum(...[1, 2, 3, 4]));
   assertEquals(10, sum(...[1, 2, 3], 4));
   assertEquals(10, sum(1, ...[2, 3], 4));
   assertEquals(10, sum(1, ...[2, 3], ...[4]));
@@ skipping 267 matching lines @@
     get: function() {
       called++;
       return it;
     }
   });
 
   countArgs(...a);
 
   assertEquals(1, called);
 })();