[es6] Add TF support for super.property

Currently does super.prop (load) and super.method() (call). Like full
codegen it uses runtime calls to load the property value.

BUG=v8:3330
LOG=N
R=mstarzinger@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1149133005

Cr-Commit-Position: refs/heads/master@{#28815}

src/compiler/ast-graph-builder.h

@@ -258,6 +258,9 @@ class AstGraphBuilder : public AstVisitor {
   // Builder to create an array of rest parameters if used
   Node* BuildRestArgumentsArray(Variable* rest, int index);
 
+  // Builder that assigns to the .this_function internal variable if needed.
+  Node* BuildThisFunctionVar(Variable* this_function_var);
+
   // Builders for variable load and assignment.
   Node* BuildVariableAssignment(Variable* variable, Node* value,
                                 Token::Value op, BailoutId bailout_id,
@@ -283,6 +286,16 @@ class AstGraphBuilder : public AstVisitor {
   Node* BuildNamedStore(Node* receiver, Handle<Name>, Node* value,
                         TypeFeedbackId id);
 
+  // Builders for super property loads and stores.
+  Node* BuildKeyedSuperStore(Node* receiver, Node* home_object, Node* key,
+                             Node* value, TypeFeedbackId id);
+  Node* BuildNamedSuperStore(Node* receiver, Node* home_object,
+                             Handle<Name> name, Node* value, TypeFeedbackId id);
+  Node* BuildNamedSuperLoad(Node* receiver, Node* home_object,
+                            Handle<Name> name, const VectorSlotPair& feedback);
+  Node* BuildKeyedSuperLoad(Node* receiver, Node* home_object, Node* key,
+                            const VectorSlotPair& feedback);
+
   // Builders for accessing the function context.
   Node* BuildLoadBuiltinsObject();
   Node* BuildLoadGlobalObject();