A JavaScript class's prototype method called with a receiver that is not an
instance of its class (`C.prototype.m.call(other)`, or an object that
inherits the method) now behaves as in Node when it uses private members or
calls super methods, instead of throwing "expected C" for the receiver.
- Private fields keep their brand check: reading or writing `this.#x` throws
"Cannot read private member #x from an object whose class did not declare
it" (or the write message), and `#x in this` answers false.
- `this.#m()` brand-checks the receiver through a new `call` use of the
private brand helpers and throws "Receiver must be an instance of class C"
(V8's wording: the class's own identifier, "anonymous" without one, and
"Cannot read properties of undefined (reading 'C')" for a nullish
receiver). It also applies to private method calls on other
checked-dynamic values.
- `super.m(...)` looks the method up on the base class's complete prototype
object and calls it with the receiver, as `super` reads
[[HomeObject]].[[Prototype]].
Methods that use `super` in other positions, static methods with private
names, and classes whose base chain includes a function-local, generic,
mixin, Date or runtime-provided class keep the native receiver check. The
receiver-independent method lowering and the prototype reflection now mark
their frames as `this` boundaries, so lowering one class's members on top of
another method's frames (a super call reflecting the base) never reaches the
caller's `this`.
Chris Tate
03807c0c35