[turbofan] Fix receiver binding for inlined callees.

src/compiler/js-intrinsic-lowering.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-intrinsic-lowering.h"
 
 #include <stack>
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 513 matching lines @@
 }
 
 
 Reduction JSIntrinsicLowering::ReduceToObject(Node* node) {
   NodeProperties::ChangeOp(node, javascript()->ToObject());
   return Changed(node);
 }
 
 
 Reduction JSIntrinsicLowering::ReduceCallFunction(Node* node) {
-  CallRuntimeParameters params = OpParameter<CallRuntimeParameters>(node->op());
+  CallRuntimeParameters params = CallRuntimeParametersOf(node->op());
   size_t arity = params.arity();
   Node* function = node->InputAt(static_cast<int>(arity - 1));
   while (--arity != 0) {
     node->ReplaceInput(static_cast<int>(arity),
                        node->InputAt(static_cast<int>(arity - 1)));
   }
   node->ReplaceInput(0, function);
   NodeProperties::ChangeOp(
-      node,
-      javascript()->CallFunction(params.arity(), NO_CALL_FUNCTION_FLAGS, STRICT,
-                                 VectorSlotPair(), ALLOW_TAIL_CALLS));
+      node, javascript()->CallFunction(
+                params.arity(), NO_CALL_FUNCTION_FLAGS, STRICT,
+                VectorSlotPair(), ConvertReceiverMode::kAny, ALLOW_TAIL_CALLS));
   return Changed(node);
 }
 
 
 Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op, Node* a,
                                       Node* b) {
   RelaxControls(node);
   node->ReplaceInput(0, a);
   node->ReplaceInput(1, b);
   node->TrimInputCount(2);
@@ skipping 50 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSIntrinsicLowering::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8