[turbofan] Fix receiver binding for inlined callees.

src/compiler/js-inlining.cc

Index: src/compiler/js-inlining.cc
diff --git a/src/compiler/js-inlining.cc b/src/compiler/js-inlining.cc
index 3dd02b1e06d7b52445ac0d280ef63d27457eb97a..571ef82ffa4855a2bba98bff5e851fe05d5b739a 100644
--- a/src/compiler/js-inlining.cc
+++ b/src/compiler/js-inlining.cc
@@ -420,6 +420,18 @@ Reduction JSInliner::ReduceJSCallFunction(Node* node,
     frame_state = CreateArgumentsAdaptorFrameState(&call, info.shared_info());
   }
 
+  // Insert a JSConvertReceiver node for sloppy callees. Note that the context
+  // passed into this node has to be the callees context (loaded above).
+  if (is_sloppy(info.language_mode()) && !function->IsBuiltin()) {

[Benedikt Meurer, 2015/10/27 11:37:34]

I think this has to check shared_info->native() instead of
function->IsBuiltin().

[Michael Starzinger, 2015/10/27 11:43:17]

Done.

+    const CallFunctionParameters& p = CallFunctionParametersOf(node->op());
+    Node* effect = NodeProperties::GetEffectInput(node);
+    Node* convert = jsgraph_->graph()->NewNode(
+        jsgraph_->javascript()->ConvertReceiver(p.convert_mode()),
+        call.receiver(), context, frame_state, effect, start);
+    NodeProperties::ReplaceValueInput(node, convert, 1);
+    NodeProperties::ReplaceEffectInput(node, convert);
+  }
+
   return InlineCall(node, context, frame_state, start, end);
 }