[turbofan] Fix super property calls to act as method calls.

This fixes [NAMED|KEYED]_SUPER_PROPERTY_CALL to perform a method call
instead of a function call. The difference is visible for sloppy mode
targets that convert primitive receivers.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-4525
BUG=v8:4525
LOG=n

Review URL: https://codereview.chromium.org/1419173004

Cr-Commit-Position: refs/heads/master@{#31664}

src/compiler/ast-graph-builder.cc

@@ -2353,7 +2353,7 @@ void AstGraphBuilder::VisitCall(Call* expr) {
       callee_value = BuildNamedLoad(object, name, feedback);
       states.AddToNode(callee_value, property->LoadId(),
                        OutputFrameStateCombine::Push());
-      // Note that a PROPERTY_CALL requires the receiver to be wrapped into
+      // Note that a property call requires the receiver to be wrapped into
       // an object for sloppy callees. However the receiver is guaranteed
       // not to be null or undefined at this point.
       receiver_hint = ConvertReceiverMode::kNotNullOrUndefined;
@@ -2373,7 +2373,7 @@ void AstGraphBuilder::VisitCall(Call* expr) {
       callee_value = BuildKeyedLoad(object, key, feedback);
       states.AddToNode(callee_value, property->LoadId(),
                        OutputFrameStateCombine::Push());
-      // Note that a PROPERTY_CALL requires the receiver to be wrapped into
+      // Note that a property call requires the receiver to be wrapped into
       // an object for sloppy callees. However the receiver is guaranteed
       // not to be null or undefined at this point.
       receiver_hint = ConvertReceiverMode::kNotNullOrUndefined;
@@ -2394,9 +2394,11 @@ void AstGraphBuilder::VisitCall(Call* expr) {
       callee_value = BuildNamedSuperLoad(object, home, name, VectorSlotPair());
       states.AddToNode(callee_value, property->LoadId(),
                        OutputFrameStateCombine::Push());
-      // Note that the receiver is not the target of the property load, so
-      // it could very well be null or undefined at this point.
+      // Note that a property call requires the receiver to be wrapped into
+      // an object for sloppy callees. Since the receiver is not the target of
+      // the load, it could very well be null or undefined at this point.
       receiver_value = environment()->Pop();
+      flags = CALL_AS_METHOD;
       environment()->Drop(1);
       break;
     }
@@ -2416,9 +2418,11 @@ void AstGraphBuilder::VisitCall(Call* expr) {
       callee_value = BuildKeyedSuperLoad(object, home, key, VectorSlotPair());
       states.AddToNode(callee_value, property->LoadId(),
                        OutputFrameStateCombine::Push());
-      // Note that the receiver is not the target of the property load, so
-      // it could very well be null or undefined at this point.
+      // Note that a property call requires the receiver to be wrapped into
+      // an object for sloppy callees. Since the receiver is not the target of
+      // the load, it could very well be null or undefined at this point.
       receiver_value = environment()->Pop();
+      flags = CALL_AS_METHOD;
       environment()->Drop(1);
       break;
     }

test/mjsunit/regress/regress-4525.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function receiver() {
+  return this;
+}
+
+function construct(f) {
+  "use strict";
+  class B {}
+  class C extends B {
+    bar() { return super.foo() }
+  }
+  B.prototype.foo = f;
+  return new C();
+}
+
+function check(x, value, type) {
+  assertEquals("object", typeof x);
+  assertInstanceof(x, type);
+  assertEquals(value, x);
+}
+
+var o = construct(receiver);
+check(o.bar.call(123), Object(123), Number);
+check(o.bar.call("a"), Object("a"), String);
+// TODO(4526): Should convert to global receiver instead of throwing TypeError.
+// check(o.bar.call(undefined), this, Object);
+// check(o.bar.call(null), this, Object);
+
+%OptimizeFunctionOnNextCall(o.bar);
+check(o.bar.call(456), Object(456), Number);
+check(o.bar.call("b"), Object("b"), String);
+// TODO(4526): Should convert to global receiver instead of throwing TypeError.
+// check(o.bar.call(undefined), this, Object);
+// check(o.bar.call(null), this, Object);