[turbofan] Fix usage of ThisFunction parameter in OSR.

src/compiler/linkage-impl.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_LINKAGE_IMPL_H_
 #define V8_COMPILER_LINKAGE_IMPL_H_
 
 #include "src/code-stubs.h"
 #include "src/compiler/osr.h"
 
@@ skipping 11 matching lines @@
     DCHECK(locations->return_count_ <= 2);
     if (locations->return_count_ > 0) {
       locations->AddReturn(regloc(LinkageTraits::ReturnValueReg()));
     }
     if (locations->return_count_ > 1) {
       locations->AddReturn(regloc(LinkageTraits::ReturnValue2Reg()));
     }
   }
 
   // TODO(turbofan): cache call descriptors for JSFunction calls.
-  static CallDescriptor* GetJSCallDescriptor(Zone* zone, int js_parameter_count,
+  static CallDescriptor* GetJSCallDescriptor(Zone* zone, bool is_osr,
+                                             int js_parameter_count,
                                              CallDescriptor::Flags flags) {
     const size_t return_count = 1;
     const size_t context_count = 1;
     const size_t parameter_count = js_parameter_count + context_count;
 
     LocationSignature::Builder locations(zone, return_count, parameter_count);
     MachineSignature::Builder types(zone, return_count, parameter_count);
 
     // Add returns.
     AddReturnLocations(&locations);
     for (size_t i = 0; i < return_count; i++) {
       types.AddReturn(kMachAnyTagged);
     }
 
     // All parameters to JS calls go on the stack.
     for (int i = 0; i < js_parameter_count; i++) {
       int spill_slot_index = i - js_parameter_count;
       locations.AddParam(stackloc(spill_slot_index));
       types.AddParam(kMachAnyTagged);
     }
     // Add context.
     locations.AddParam(regloc(LinkageTraits::ContextReg()));
     types.AddParam(kMachAnyTagged);
 
     // The target for JS function calls is the JSFunction object.
     MachineType target_type = kMachAnyTagged;
-    LinkageLocation target_loc = regloc(LinkageTraits::JSCallFunctionReg());
+    // Unoptimized code doesn't preserve the JSCallFunctionReg, so expect the
+    // closure on the stack.
+    LinkageLocation target_loc =
+        is_osr ? stackloc(Linkage::kJSFunctionCallClosureParamIndex -
+                          js_parameter_count)
+               : regloc(LinkageTraits::JSCallFunctionReg());
     return new (zone) CallDescriptor(     // --
         CallDescriptor::kCallJSFunction,  // kind
         target_type,                      // target MachineType
         target_loc,                       // target location
         types.Build(),                    // machine_sig
         locations.Build(),                // location_sig
         js_parameter_count,               // js_parameter_count
         Operator::kNoProperties,          // properties
         kNoCalleeSaved,                   // callee-saved
         flags,                            // flags
@@ skipping 177 matching lines @@
     return incoming_->GetInputLocation(parameter_index);
   }
 }
 
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_COMPILER_LINKAGE_IMPL_H_