[turbofan] Fix super property calls to act as method calls.

test/mjsunit/regress/regress-4525.js

Index: test/mjsunit/regress/regress-4525.js
diff --git a/test/mjsunit/regress/regress-4525.js b/test/mjsunit/regress/regress-4525.js
new file mode 100644
index 0000000000000000000000000000000000000000..dd2de701f7f4ac21f1cee64ea34513cb53c6139a
--- /dev/null
+++ b/test/mjsunit/regress/regress-4525.js
@@ -0,0 +1,39 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function receiver() {
+  return this;
+}
+
+function construct(f) {
+  "use strict";
+  class B {}
+  class C extends B {
+    bar() { return super.foo() }
+  }
+  B.prototype.foo = f;
+  return new C();
+}
+
+function check(x, value, type) {
+  assertEquals("object", typeof x);
+  assertInstanceof(x, type);
+  assertEquals(value, x);
+}
+
+var o = construct(receiver);
+check(o.bar.call(123), Object(123), Number);
+check(o.bar.call("a"), Object("a"), String);
+// TODO(4526): Should convert to global receiver instead of throwing TypeError.
+// check(o.bar.call(undefined), this, Object);
+// check(o.bar.call(null), this, Object);
+
+%OptimizeFunctionOnNextCall(o.bar);
+check(o.bar.call(456), Object(456), Number);
+check(o.bar.call("b"), Object("b"), String);
+// TODO(4526): Should convert to global receiver instead of throwing TypeError.
+// check(o.bar.call(undefined), this, Object);
+// check(o.bar.call(null), this, Object);