[es6] implement spread calls

src/runtime/runtime-function.cc

Index: src/runtime/runtime-function.cc
diff --git a/src/runtime/runtime-function.cc b/src/runtime/runtime-function.cc
index 5d49b2368153701eb833a61de309a57f685a9b54..d0cd6f8c3c05b597418262f1d15ecfea8c700474 100644
--- a/src/runtime/runtime-function.cc
+++ b/src/runtime/runtime-function.cc
@@ -611,6 +611,42 @@ RUNTIME_FUNCTION(Runtime_Apply) {
 }
 
 
+RUNTIME_FUNCTION(Runtime_ApplyConstruct) {
+  HandleScope scope(isolate);
+  DCHECK(args.length() == 4);
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, fun, 0);
+  CONVERT_ARG_HANDLE_CHECKED(JSObject, arguments, 1);
+  CONVERT_INT32_ARG_CHECKED(offset, 2);
+  CONVERT_INT32_ARG_CHECKED(argc, 3);
+  RUNTIME_ASSERT(offset >= 0);
+  // Loose upper bound to allow fuzzing. We'll most likely run out of
+  // stack space before hitting this limit.
+  static int kMaxArgc = 1000000;
+  RUNTIME_ASSERT(argc >= 0 && argc <= kMaxArgc);
+
+  // If there are too many arguments, allocate argv via malloc.
+  const int argv_small_size = 10;
+  Handle<Object> argv_small_buffer[argv_small_size];
+  SmartArrayPointer<Handle<Object> > argv_large_buffer;
+  Handle<Object>* argv = argv_small_buffer;
+  if (argc > argv_small_size) {
+    argv = new Handle<Object>[argc];
+    if (argv == NULL) return isolate->StackOverflow();
+    argv_large_buffer = SmartArrayPointer<Handle<Object> >(argv);
+  }
+
+  for (int i = 0; i < argc; ++i) {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, argv[i], Object::GetElement(isolate, arguments, offset + i));
+  }
+
+  Handle<Object> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                     Execution::New(fun, argc, argv));
+  return *result;
+}
+
+
 RUNTIME_FUNCTION(Runtime_GetFunctionDelegate) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 1);