CallOrConstructWithArrayLike and CallOrConstructWithSpread builtins
expect only Smi in the array length field. This is true when we
have fast elements kind, but for dictionary mode we can have HeapNumbers
This cl fixes by moving the loading of length fields after the check
on elements kind to avoid loading length fields on dictionary mode
JSArrays.

Change-Id: I838a260353efa25fb0357e6f03247d3075cebe3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431206
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70133}