REGRESSION: super.prop throws 'Cannot convert undefined or null to object' (~24) + new.target-in-direct-eval over-rejected (6)

[proggeramlug]

Severity: HIGH (super.prop broadly broken)

Re-measure 2026-06-29 (main @ c002052c3, perry 0.5.1208, node v26.3.0) — overall parity 95.3% (129 fixed) but 32 newly-failing vs the prior sweep, in two regression clusters.

Cluster A — super.prop → "Cannot convert undefined or null to object" (~24)

super.x / super[expr] reads (and a few built-ins sharing the ToObject path) now throw. The super-base ([[HomeObject]].[[GetPrototypeOf]]) is resolving to undefined/null.

language/expressions/super/prop-dot-obj-val.js
language/expressions/super/prop-expr-obj-val.js
language/expressions/super/prop-expr-getsuperbase-before-topropertykey-getvalue.js   (+ putvalue)
language/expressions/super/prop-{dot,expr}-obj-val-from-{arrow,eval}.js
language/expressions/object/method.js
language/expressions/object/{getter,setter}-super-prop.js
language/expressions/object/concise-generator.js
language/expressions/object/method-definition/async-super-call-{body,param}.js
language/computed-property-names/object/accessor/{getter,setter}-super.js
language/computed-property-names/object/method/super.js
language/eval-code/direct/super-prop-method.js
built-ins/Array/prototype/{indexOf,lastIndexOf}/calls-only-has-on-prototype-after-length-zeroed.js
built-ins/Function/prototype/bind/instance-length-default-value.js
built-ins/Object/setPrototypeOf/success.js · built-ins/Proxy/setPrototypeOf/call-parameters.js
built-ins/TypedArray/prototype/buffer/this-inherits-typedarray.js
built-ins/SharedArrayBuffer/prototype/slice/species-constructor-is-undefined.js  (no output)

Suspects (this window): 5d47364e2 (#5772 — "deforest: rewrite producer call sites in class member bodies", directly rewrites the member bodies where super lives) is PRIME; c002052c3 (#5775 — method-dispatch depth guard across longjmp) secondary. Bisect with language/expressions/super/prop-dot-obj-val.js.

Cluster B — new.target in direct eval over-rejected (6)

language/{expressions,statements}/class/elements/{,arrow-body-,nested-}private-direct-eval-err-contains-newtarget.js   SyntaxError: new.target expression is not allowed

Suspect: 1d8357803 (#5766 — "SyntaxError for new.target in direct eval outside non-arrow function"). A class private method IS a function, so new.target inside its direct eval is allowed — #5766 is over-rejecting.

Measure

scripts/test262_subset.py --root vendor/test262 --dir language/expressions/super language/expressions/object language/computed-property-names language/expressions/class language/statements/class --jobs 8

[proggeramlug]

Cluster A root CONFIRMED: #5772 (5d47364) extended the deforest pass (detect + phase-3 rewrite + max_local_id seeding) to class/object member bodies. A member body that references super has its super-base ([[HomeObject]]) setup corrupted by that rewrite/id-seeding, hence super.prop → 'Cannot convert undefined or null to object'. #5772 is NOT revert-safe (it fixes a real SIGSEGV/arity-mismatch, #5136-class). Safe surgical fix: in deforest/detect.rs, treat a member body that references super (super.prop / super[expr] / super(...)) as an unsafe/bail-out body (mirror the in-closure bail), so it's excluded from deforest detection+rewrite. This preserves #5772's SIGSEGV fix for super-free methods and restores super. Re-dispatching cluster A with this recipe.