[esnext] Fix super in async arrow functions

Ordinary arrow functions have 'undefined' in their frame's receiver.
Generators restore the receiver to the frame based on one passed in
when they are constructed in CreateJSGeneratorObject.

This patch makes async arrow functions pass in 'undefined' for their
receiver so that they have the same behavior as ordinary arrow
functions, which avoids the issue of encountering TDZ when calling
an async arrow function in a subclass constructor before a super
call has returned.

BUG=v8:4483

Review-Url: https://codereview.chromium.org/1976813002
Cr-Commit-Position: refs/heads/master@{#36264}

src/parsing/parser.cc

@@ -4025,7 +4025,7 @@ void Parser::DesugarAsyncFunctionBody(const AstRawString* function_name,
 
   Expression* init_generator_variable = factory()->NewAssignment(
       Token::INIT, factory()->NewVariableProxy(temp),
-      BuildCreateJSGeneratorObject(pos), RelocInfo::kNoPosition);
+      BuildCreateJSGeneratorObject(pos, kind), RelocInfo::kNoPosition);
   body->Add(factory()->NewExpressionStatement(init_generator_variable,
                                               RelocInfo::kNoPosition),
             zone());
@@ -4627,11 +4627,14 @@ Block* Parser::BuildRejectPromiseOnException(Block* block) {
   return block;
 }
 
-Expression* Parser::BuildCreateJSGeneratorObject(int pos) {
+Expression* Parser::BuildCreateJSGeneratorObject(int pos, FunctionKind kind) {
   DCHECK_NOT_NULL(function_state_->generator_object_variable());
   ZoneList<Expression*>* args = new (zone()) ZoneList<Expression*>(2, zone());
   args->Add(factory()->NewThisFunction(pos), zone());
-  args->Add(ThisExpression(scope_, factory(), RelocInfo::kNoPosition), zone());
+  args->Add(IsArrowFunction(kind)
+                ? GetLiteralUndefined(pos)
+                : ThisExpression(scope_, factory(), RelocInfo::kNoPosition),
+            zone());
   return factory()->NewCallRuntime(Runtime::kCreateJSGeneratorObject, args,
                                    pos);
 }
@@ -4702,7 +4705,7 @@ ZoneList<Statement*>* Parser::ParseEagerFunctionBody(
           factory()->NewBlock(nullptr, 3, false, RelocInfo::kNoPosition);
 
       {
-        Expression* allocation = BuildCreateJSGeneratorObject(pos);
+        Expression* allocation = BuildCreateJSGeneratorObject(pos, kind);
         VariableProxy* init_proxy = factory()->NewVariableProxy(
             function_state_->generator_object_variable());
         Assignment* assignment = factory()->NewAssignment(

src/parsing/parser.h

@@ -1096,7 +1096,7 @@ class Parser : public ParserBase<ParserTraits> {
   friend class InitializerRewriter;
   void RewriteParameterInitializer(Expression* expr, Scope* scope);
 
-  Expression* BuildCreateJSGeneratorObject(int pos);
+  Expression* BuildCreateJSGeneratorObject(int pos, FunctionKind kind);
   Expression* BuildPromiseResolve(Expression* value, int pos);
   Expression* BuildPromiseReject(Expression* value, int pos);
 

test/mjsunit/mjsunit.status

@@ -55,9 +55,6 @@
   'es6/debug-promises/reject-with-undefined-reject': [FAIL],
   'es6/debug-promises/reject-with-invalid-reject': [FAIL],
 
-  # TODO(caitp): fix super-call and super-property in async arrow functions
-  'harmony/async-arrow-lexical-super': [FAIL],
-
   ##############################################################################
   # TurboFan compiler failures.