Fix issue 267: Functions now called with global object as receiver.

src/codegen-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3894 matching lines @@
     } else {
       // -------------------------------------------
       // JavaScript example: 'array[index](1, 2, 3)'
       // -------------------------------------------
 
       // Load the function to call from the property through a reference.
       Reference ref(this, property);
       ref.GetValue(NOT_INSIDE_TYPEOF);
 
       // Pass receiver to called function.
-      // The reference's size is non-negative.
-      frame_->SpillAll();
-      frame_->EmitPush(frame_->ElementAt(ref.size()));
+      if (property->is_synthetic()) {
+        // Use global object as receiver.
+        LoadGlobalReceiver();
+      } else {
+        // The reference's size is non-negative.
+        frame_->SpillAll();

[Kevin Millikin (Chromium), 2009/03/10 12:10:10]

I know it's not your code, but you could try getting rid of the SpillAll here
and changing the EmitPush to PushElementAt, just to see what happens.  In
theory, it should work.

[Lasse Reichstein, 2009/03/10 12:21:08]

Done.

+        frame_->EmitPush(frame_->ElementAt(ref.size()));
+      }
 
       // Call the function.
       CallWithArguments(args, node->position());
     }
 
   } else {
     // ----------------------------------
     // JavaScript example: 'foo(1, 2, 3)'  // foo is not global
     // ----------------------------------
 
@@ skipping 3008 matching lines @@
 
   // Slow-case: Go through the JavaScript implementation.
   __ bind(&slow);
   __ InvokeBuiltin(Builtins::INSTANCE_OF, JUMP_FUNCTION);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal