[turbofan] Fix receiver binding for inlined callees.

src/runtime/runtime-function.cc

Index: src/runtime/runtime-function.cc
diff --git a/src/runtime/runtime-function.cc b/src/runtime/runtime-function.cc
index f994ee336561a3c51da186de4783480b75bf0a92..5e212a5bc9c861779050a78db930f728fbe36280 100644
--- a/src/runtime/runtime-function.cc
+++ b/src/runtime/runtime-function.cc
@@ -547,6 +547,18 @@ RUNTIME_FUNCTION(Runtime_GetOriginalConstructor) {
 }
 
 
+// ES6 section 9.2.1.2, OrdinaryCallBindThis for sloppy callee.
+RUNTIME_FUNCTION(Runtime_ConvertReceiver) {
+  HandleScope scope(isolate);
+  DCHECK(args.length() == 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 0);
+  if (receiver->IsNull() || receiver->IsUndefined()) {
+    return isolate->global_proxy();
+  }
+  return *Object::ToObject(isolate, receiver).ToHandleChecked();
+}
+
+
 // TODO(bmeurer): Kill %_CallFunction ASAP as it is almost never used
 // correctly because of the weird semantics underneath.
 RUNTIME_FUNCTION(Runtime_CallFunction) {