Repository navigation
REGRESSION: super.prop throws 'Cannot convert undefined or null to object' (~24) + new.target-in-direct-eval over-rejected (6) #5780
Description
Severity: HIGH (super.prop broadly broken)
Re-measure 2026-06-29 (main @ c002052c3, perry 0.5.1208, node v26.3.0) — overall parity 95.3% (129 fixed) but 32 newly-failing vs the prior sweep, in two regression clusters.
Cluster A — super.prop → "Cannot convert undefined or null to object" (~24)
super.x / super[expr] reads (and a few built-ins sharing the ToObject path) now throw. The super-base ([[HomeObject]].[[GetPrototypeOf]]) is resolving to undefined/null.
language/expressions/super/prop-dot-obj-val.js
language/expressions/super/prop-expr-obj-val.js
language/expressions/super/prop-expr-getsuperbase-before-topropertykey-getvalue.js (+ putvalue)
language/expressions/super/prop-{dot,expr}-obj-val-from-{arrow,eval}.js
language/expressions/object/method.js
language/expressions/object/{getter,setter}-super-prop.js
language/expressions/object/concise-generator.js
language/expressions/object/method-definition/async-super-call-{body,param}.js
language/computed-property-names/object/accessor/{getter,setter}-super.js
language/computed-property-names/object/method/super.js
language/eval-code/direct/super-prop-method.js
built-ins/Array/prototype/{indexOf,lastIndexOf}/calls-only-has-on-prototype-after-length-zeroed.js
built-ins/Function/prototype/bind/instance-length-default-value.js
built-ins/Object/setPrototypeOf/success.js · built-ins/Proxy/setPrototypeOf/call-parameters.js
built-ins/TypedArray/prototype/buffer/this-inherits-typedarray.js
built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js (no output)
Suspects (this window): 5d47364e2 (#5772 — "deforest: rewrite producer call sites in class member bodies", directly rewrites the member bodies where super lives) is PRIME; c002052c3 (#5775 — method-dispatch depth guard across longjmp) secondary. Bisect with language/expressions/super/prop-dot-obj-val.js.
Cluster B — new.target in direct eval over-rejected (6)
language/{expressions,statements}/class/elements/{,arrow-body-,nested-}private-direct-eval-err-contains-newtarget.js SyntaxError: new.target expression is not allowed
Suspect: 1d8357803 (#5766 — "SyntaxError for new.target in direct eval outside non-arrow function"). A class private method IS a function, so new.target inside its direct eval is allowed — #5766 is over-rejecting.
Measure
scripts/test262_subset.py --root vendor/test262 --dir language/expressions/super language/expressions/object language/computed-property-names language/expressions/class language/statements/class --jobs 8
Activity
proggeramlug commentedon Jun 29, 2026
Cluster A root CONFIRMED: #5772 (5d47364) extended the deforest pass (detect + phase-3 rewrite + max_local_id seeding) to class/object member bodies. A member body that references
superhas its super-base ([[HomeObject]]) setup corrupted by that rewrite/id-seeding, hence super.prop → 'Cannot convert undefined or null to object'. #5772 is NOT revert-safe (it fixes a real SIGSEGV/arity-mismatch, #5136-class). Safe surgical fix: in deforest/detect.rs, treat a member body that referencessuper(super.prop / super[expr] / super(...)) as an unsafe/bail-out body (mirror the in-closure bail), so it's excluded from deforest detection+rewrite. This preserves #5772's SIGSEGV fix for super-free methods and restores super. Re-dispatching cluster A with this recipe.fix(deforest): exclude super-using class member bodies from call-site…