[full-codegen] Fix stack depth tracking when reporting unsupported super usages

Also mark VisitSuperCallReference as unreachable, as it's handled by VisitCall.

R=mstarzinger@chromium.org
BUG=v8:4967
LOG=n

Review-Url: https://codereview.chromium.org/1929213002
Cr-Commit-Position: refs/heads/master@{#35945}

src/full-codegen/full-codegen.cc

@@ -678,11 +678,15 @@ void FullCodeGenerator::SetCallPosition(Expression* expr,
 void FullCodeGenerator::VisitSuperPropertyReference(
     SuperPropertyReference* super) {
   __ CallRuntime(Runtime::kThrowUnsupportedSuperError);
+  // Even though this expression doesn't produce a value, we need to simulate
+  // plugging of the value context to ensure stack depth tracking is in sync.
+  if (context()->IsStackValue()) OperandStackDepthIncrement(1);
 }
 
 
 void FullCodeGenerator::VisitSuperCallReference(SuperCallReference* super) {
-  __ CallRuntime(Runtime::kThrowUnsupportedSuperError);
+  // Handled by VisitCall
+  UNREACHABLE();
 }
 
 

test/mjsunit/regress/regress-4967.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+  new class extends Object {
+    constructor() { (() => delete super[super()])(); }
+  }
+}, ReferenceError);