[turbofan] Fix receiver binding for inlined callees.

src/runtime/runtime-function.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/accessors.h"
 #include "src/arguments.h"
 #include "src/compiler.h"
 #include "src/deoptimizer.h"
@@ skipping 529 matching lines @@
 RUNTIME_FUNCTION(Runtime_GetOriginalConstructor) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 0);
   JavaScriptFrameIterator it(isolate);
   JavaScriptFrame* frame = it.frame();
   return frame->IsConstructor() ? frame->GetOriginalConstructor()
                                 : isolate->heap()->undefined_value();
 }
 
 
+// ES6 section 9.2.1.2, OrdinaryCallBindThis for sloppy callee.
+RUNTIME_FUNCTION(Runtime_ConvertReceiver) {
+  HandleScope scope(isolate);
+  DCHECK(args.length() == 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 0);
+  if (receiver->IsNull() || receiver->IsUndefined()) {
+    return isolate->global_proxy();
+  }
+  return *Object::ToObject(isolate, receiver).ToHandleChecked();
+}
+
+
 // TODO(bmeurer): Kill %_CallFunction ASAP as it is almost never used
 // correctly because of the weird semantics underneath.
 RUNTIME_FUNCTION(Runtime_CallFunction) {
   HandleScope scope(isolate);
   DCHECK(args.length() >= 2);
   int argc = args.length() - 2;
   CONVERT_ARG_CHECKED(JSReceiver, fun, argc + 1);
   Object* receiver = args[0];
 
   // If there are too many arguments, allocate argv via malloc.
@@ skipping 38 matching lines @@
 
 
 RUNTIME_FUNCTION(Runtime_ThrowStrongModeTooFewArguments) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 0);
   THROW_NEW_ERROR_RETURN_FAILURE(isolate,
                                  NewTypeError(MessageTemplate::kStrongArity));
 }
 }  // namespace internal
 }  // namespace v8