[turbofan] Fix receiver binding for inlined callees.

src/compiler/js-inlining.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining.h"
 
 #include "src/ast.h"
 #include "src/ast-numbering.h"
 #include "src/compiler.h"
 #include "src/compiler/all-nodes.h"
@@ skipping 402 matching lines @@
 
   // Insert argument adaptor frame if required. The callees formal parameter
   // count (i.e. value outputs of start node minus target, receiver & context)
   // have to match the number of arguments passed to the call.
   DCHECK_EQ(static_cast<int>(parameter_count),
             start->op()->ValueOutputCount() - 3);
   if (call.formal_arguments() != parameter_count) {
     frame_state = CreateArgumentsAdaptorFrameState(&call, info.shared_info());
   }
 
+  // Insert a JSConvertReceiver node for sloppy callees. Note that the context
+  // passed into this node has to be the callees context (loaded above).
+  if (is_sloppy(info.language_mode()) && !function->shared()->native()) {
+    const CallFunctionParameters& p = CallFunctionParametersOf(node->op());
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* convert = jsgraph_->graph()->NewNode(
+        jsgraph_->javascript()->ConvertReceiver(p.convert_mode()),
+        call.receiver(), context, frame_state, effect, start);
+    NodeProperties::ReplaceValueInput(node, convert, 1);
+    NodeProperties::ReplaceEffectInput(node, convert);
+  }
+
   return InlineCall(node, context, frame_state, start, end);
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8