[es6] support spread-calling Super-accessing properties

BUG=v8:4105, v8:3018
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1132933003

Cr-Commit-Position: refs/heads/master@{#28405}

src/parser.cc

@@ -5708,17 +5708,25 @@ Expression* Parser::SpreadCall(Expression* function,
   } else {
     if (function->IsProperty()) {
       // Method calls
-      Variable* temp =
-          scope_->NewTemporary(ast_value_factory()->empty_string());
-      VariableProxy* obj = factory()->NewVariableProxy(temp);
-      Assignment* assign_obj = factory()->NewAssignment(
-          Token::ASSIGN, obj, function->AsProperty()->obj(),
-          RelocInfo::kNoPosition);
-      function = factory()->NewProperty(
-          assign_obj, function->AsProperty()->key(), RelocInfo::kNoPosition);
-      args->InsertAt(0, function, zone());
-      obj = factory()->NewVariableProxy(temp);
-      args->InsertAt(1, obj, zone());
+      if (function->AsProperty()->IsSuperAccess()) {
+        VariableProxy* original_home =
+            function->AsProperty()->obj()->AsSuperReference()->this_var();
+        VariableProxy* home = factory()->NewVariableProxy(original_home->var());
+        args->InsertAt(0, function, zone());
+        args->InsertAt(1, home, zone());
+      } else {
+        Variable* temp =
+            scope_->NewTemporary(ast_value_factory()->empty_string());
+        VariableProxy* obj = factory()->NewVariableProxy(temp);
+        Assignment* assign_obj = factory()->NewAssignment(
+            Token::ASSIGN, obj, function->AsProperty()->obj(),
+            RelocInfo::kNoPosition);
+        function = factory()->NewProperty(
+            assign_obj, function->AsProperty()->key(), RelocInfo::kNoPosition);
+        args->InsertAt(0, function, zone());
+        obj = factory()->NewVariableProxy(temp);
+        args->InsertAt(1, obj, zone());
+      }
     } else {
       // Non-method calls
       args->InsertAt(0, function, zone());

test/mjsunit/harmony/spread-call-super-property.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-spreadcalls --harmony-sloppy --harmony-rest-parameters
+
+(function testCallSuperProperty() {
+  class BaseClass {
+    strict_method(...args) { "use strict"; return [this].concat(args); }
+    sloppy_method(...args) { return [this].concat(args); }
+  }
+  class SubClass extends BaseClass {
+    strict_m(...args) { return super.strict_method(...args); }
+    sloppy_m(...args) { return super.sloppy_method(...args); }
+  }
+
+  var c = new SubClass();
+  assertEquals([c, 1, 2, 3, 4, 5], c.strict_m(1, 2, 3, 4, 5));
+  assertEquals([c, 1, 2, 3, 4, 5], c.sloppy_m(1, 2, 3, 4, 5));
+})();