Remove GetDefaultReceiver, pass in undefined to sloppy-mode functions instead.

src/string.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var $stringCharAt;
 var $stringIndexOf;
 var $stringSubstring;
 
 (function() {
 
@@ skipping 273 matching lines @@
     return %StringReplaceOneCharWithString(subject, search, replace);
   }
   var start = %StringIndexOf(subject, search, 0);
   if (start < 0) return subject;
   var end = start + search.length;
 
   var result = %_SubString(subject, 0, start);
 
   // Compute the string to replace with.
   if (IS_SPEC_FUNCTION(replace)) {
-    var receiver = %GetDefaultReceiver(replace);
+    var receiver = UNDEFINED;
     result += %_CallFunction(receiver, search, start, subject, replace);
   } else {
     reusableMatchInfo[CAPTURE0] = start;
     reusableMatchInfo[CAPTURE1] = end;
     result = ExpandReplacement(TO_STRING_INLINE(replace),
                                subject,
                                reusableMatchInfo,
                                result);
   }
 
@@ skipping 128 matching lines @@
   var len = res.length;
   if (NUMBER_OF_CAPTURES($regexpLastMatchInfo) == 2) {
     // If the number of captures is two then there are no explicit captures in
     // the regexp, just the implicit capture that captures the whole match.  In
     // this case we can simplify quite a bit and end up with something faster.
     // The builder will consist of some integers that indicate slices of the
     // input string and some replacements that were returned from the replace
     // function.
     var match_start = 0;
     var override = new InternalPackedArray(null, 0, subject);
-    var receiver = %GetDefaultReceiver(replace);
     for (var i = 0; i < len; i++) {
       var elem = res[i];
       if (%_IsSmi(elem)) {
         // Integers represent slices of the original string.  Use these to
         // get the offsets we need for the override array (so things like
         // RegExp.leftContext work during the callback function.
         if (elem > 0) {
           match_start = (elem >> 11) + (elem & 0x7ff);
         } else {
           match_start = res[++i] - elem;
         }
       } else {
         override[0] = elem;
         override[1] = match_start;
         $regexpLastMatchInfoOverride = override;
         var func_result =
-            %_CallFunction(receiver, elem, match_start, subject, replace);
+            %_CallFunction(UNDEFINED, elem, match_start, subject, replace);
         // Overwrite the i'th element in the results with the string we got
         // back from the callback function.
         res[i] = TO_STRING_INLINE(func_result);
         match_start += elem.length;
       }
     }
   } else {
-    var receiver = %GetDefaultReceiver(replace);
     for (var i = 0; i < len; i++) {
       var elem = res[i];
       if (!%_IsSmi(elem)) {
         // elem must be an Array.
         // Use the apply argument as backing for global RegExp properties.
         $regexpLastMatchInfoOverride = elem;
-        var func_result = %Apply(replace, receiver, elem, 0, elem.length);
+        var func_result = %Apply(replace, UNDEFINED, elem, 0, elem.length);
         // Overwrite the i'th element in the results with the string we got
         // back from the callback function.
         res[i] = TO_STRING_INLINE(func_result);
       }
     }
   }
   var result = %StringBuilderConcat(res, res.length, subject);
   resultArray.length = 0;
   reusableReplaceArray = resultArray;
   return result;
 }
 
 
 function StringReplaceNonGlobalRegExpWithFunction(subject, regexp, replace) {
   var matchInfo = $regexpExec(regexp, subject, 0);
   if (IS_NULL(matchInfo)) {
     regexp.lastIndex = 0;
     return subject;
   }
   var index = matchInfo[CAPTURE0];
   var result = %_SubString(subject, 0, index);
   var endOfMatch = matchInfo[CAPTURE1];
   // Compute the parameter list consisting of the match, captures, index,
   // and subject for the replace function invocation.
   // The number of captures plus one for the match.
   var m = NUMBER_OF_CAPTURES(matchInfo) >> 1;
   var replacement;
-  var receiver = %GetDefaultReceiver(replace);
   if (m == 1) {
     // No captures, only the match, which is always valid.
     var s = %_SubString(subject, index, endOfMatch);
     // Don't call directly to avoid exposing the built-in global object.
-    replacement = %_CallFunction(receiver, s, index, subject, replace);
+    replacement = %_CallFunction(UNDEFINED, s, index, subject, replace);
   } else {
     var parameters = new InternalArray(m + 2);
     for (var j = 0; j < m; j++) {
       parameters[j] = CaptureString(subject, matchInfo, j);
     }
     parameters[j] = index;
     parameters[j + 1] = subject;
 
-    replacement = %Apply(replace, receiver, parameters, 0, j + 2);
+    replacement = %Apply(replace, UNDEFINED, parameters, 0, j + 2);
   }
 
   result += replacement;  // The add method converts to string if necessary.
   // Can't use matchInfo any more from here, since the function could
   // overwrite it.
   return result + %_SubString(subject, endOfMatch, subject.length);
 }
 
 
 // ECMA-262 section 15.5.4.12
@@ skipping 640 matching lines @@
   "strike", StringStrike,
   "sub", StringSub,
   "sup", StringSup
 ]);
 
 $stringCharAt = StringCharAtJS;
 $stringIndexOf = StringIndexOfJS;
 $stringSubstring = StringSubstring;
 
 })();