[Builtins] Smi-check the spread and go to runtime in CheckSpreadAndPushToStack.

src/builtins/arm/builtins-arm.cc

Index: src/builtins/arm/builtins-arm.cc
diff --git a/src/builtins/arm/builtins-arm.cc b/src/builtins/arm/builtins-arm.cc
index 779fba4ee8741b43aee3ae9f2d384518e5b0a6aa..207974258f5a3eae10ab19f1f403996808b0d066 100644
--- a/src/builtins/arm/builtins-arm.cc
+++ b/src/builtins/arm/builtins-arm.cc
@@ -2632,10 +2632,11 @@ static void CheckSpreadAndPushToStack(MacroAssembler* masm) {
 
   Register spread_len = r5;
 
+  Label runtime_call, push_args;
   __ ldr(spread, MemOperand(sp, 0));
+  __ JumpIfSmi(spread, &runtime_call);
   __ ldr(spread_map, FieldMemOperand(spread, HeapObject::kMapOffset));
 
-  Label runtime_call, push_args;
   // Check that the spread is an array.
   __ CompareInstanceType(spread_map, scratch, JS_ARRAY_TYPE);
   __ b(ne, &runtime_call);