[turbofan] Always load context from target when lowering to direct call.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 15fa34b7ed15ed0a9534bfbf3583a12ca6b89e5e..f399ab6886c07cfbea5ec535e395f783e660cc30 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -1943,8 +1943,10 @@ Reduction JSTypedLowering::ReduceJSCallFunction(Node* node) {
     // See ES6 section 9.2.1 [[Call]] ( thisArgument, argumentsList ).
     if (IsClassConstructor(shared->kind())) return NoChange();
 
-    // Grab the context from the {function}.
-    Node* context = jsgraph()->Constant(handle(function->context(), isolate()));
+    // Load the context from the {target}.
+    Node* context = effect = graph()->NewNode(
+        simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
+        effect, control);
     NodeProperties::ReplaceContextInput(node, context);
 
     // Check if we need to convert the {receiver}.
@@ -1953,10 +1955,12 @@ Reduction JSTypedLowering::ReduceJSCallFunction(Node* node) {
       receiver = effect =
           graph()->NewNode(javascript()->ConvertReceiver(convert_mode),
                            receiver, context, frame_state, effect, control);
-      NodeProperties::ReplaceEffectInput(node, effect);
       NodeProperties::ReplaceValueInput(node, receiver, 1);
     }
 
+    // Update the effect dependency for the {node}.
+    NodeProperties::ReplaceEffectInput(node, effect);
+
     // Remove the eager bailout frame state.
     NodeProperties::RemoveFrameStateInput(node, 1);