Attachment 384359 Details for Bug 174212 – Part 2: Private Instance Fields

[patch] Part 2: Private Instance Fields

bug-174212-20191126114906.patch (text/plain), 160.33 KB, created by Caitlin Potter (:caitp) on 2019-11-26 08:49:06 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Caitlin Potter (:caitp)

Created: 2019-11-26 08:49:06 PST

Size: 160.33 KB

patch

obsolete

>Subversion Revision: 252886
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 304d1c2776b35cd2b8f98010516878114b703878..5e01587437e2ac813f8d3750ac8d69988fcc6128 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,43 @@
>+2019-11-19  Caitlin Potter <caitp@igalia.com>
>+
>+        [JSC] Add support for private class fields
>+        https://bugs.webkit.org/show_bug.cgi?id=174212
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Expanding upon the earlier public class fields patch, we implement the remaining (and
>+        significant parts) of the instance fields (https://tc39.es/proposal-class-fields/).
>+
>+        There are a variety of key changes here:
>+
>+            - Parser now understands the concept of private names (Token PRIVATENAME).
>+            - 1 new opcode (op_get_by_val_direct), one changed opcode (op_put_by_val_direct).
>+            - A method for creating Symbol objects with a null PrivateSymbolImpl is exposed as a
>+              LinkTimeConstant (@createPrivateSymbol).
>+            - Null Private Symbols are stored by name (not a valid identifier) in a JSScope, and
>+              are loaded from the outer scope whenever they are used by the modified opcodes.
>+
>+        The changes to op_put_by_val_direct include a new bytecode operand (PutByValFlags) which are
>+        used to distinguish between overwriting or defining a new private field. The differences are
>+        subtle, but revolve around whether or not an exception is thrown during certain accesses.
>+
>+        To illustrate, typical private field access will look like:
>+
>+        <Field Reads>
>+        resolve_scope      <scope=>, <currentScope>, "#x", GlobalProperty, 0
>+        get_from_scope     <symbol=>, <scope>, "#x", 1050624<DoNotThrowIfNotFound|GlobalProperty|NotInitialization>, 0, 0
>+        get_by_val_direct  <value=>, <receiver --- probably 'this'>, <symbol>
>+
>+        <Field Writes>
>+        resolve_scope      <scope=>, <currentScope>, "#x", GlobalProperty, 0
>+        get_from_scope     <symbol=>, <scope>, "#x", 1050624<DoNotThrowIfNotFound|GlobalProperty|NotInitialization>, 0, 0
>+        put_by_val_direct  <receiver, propably 'this'>, <symbol>, <value>, <PutByValPrivateName>
>+
>+        <Field Definition>
>+        resolve_scope      <scope=>, <currentScope>, "#x", GlobalProperty, 0
>+        get_from_scope     <symbol=>, <scope>, "#x", 1050624<DoNotThrowIfNotFound|GlobalProperty|NotInitialization>, 0, 0
>+        put_by_val_direct  <receiver, propably 'this'>, <symbol>, <value>, <PutByValPrivateName|PutByValThrowIfExists>
>+
> 2019-11-26  Caitlin Potter  <caitp@igalia.com>
> 
>         [JSC] Add support for public class fields
>diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
>index c8fec946b57fadef99dd455da8d5eb274ef11755..303078da6c5ffcb0e9bfb2a39f18b90aa75f836d 100644
>--- a/Source/JavaScriptCore/CMakeLists.txt
>+++ b/Source/JavaScriptCore/CMakeLists.txt
>@@ -529,6 +529,7 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEADERS
>     bytecode/OpcodeSize.h
>     bytecode/PropertyCondition.h
>     bytecode/PutByIdFlags.h
>+    bytecode/PutByValFlags.h
>     bytecode/SpeculatedType.h
>     bytecode/StructureSet.h
>     bytecode/SuperSampler.h
>diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>index 5e8773b06ad15c293e967279b889659a50e84092..2158692d7667a6a582961e9d85d841553286abd3 100644
>--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>@@ -1243,6 +1243,7 @@
> 		86704B8712DBA33700A9FE7B /* YarrJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8012DBA33700A9FE7B /* YarrJIT.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		86704B8812DBA33700A9FE7B /* YarrParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8112DBA33700A9FE7B /* YarrParser.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		86704B8A12DBA33700A9FE7B /* YarrPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 86704B8312DBA33700A9FE7B /* YarrPattern.h */; settings = {ATTRIBUTES = (Private, ); }; };
>+		8676C6E82346467E00FAAFF3 /* PutByValFlags.h in Headers */ = {isa = PBXBuildFile; fileRef = 8676C6E62346450B00FAAFF3 /* PutByValFlags.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		868916B0155F286300CB2B9A /* PrivateName.h in Headers */ = {isa = PBXBuildFile; fileRef = 868916A9155F285400CB2B9A /* PrivateName.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		868921C21F9C0CB7001159F6 /* JSBigInt.h in Headers */ = {isa = PBXBuildFile; fileRef = 868921C11F9C0CB7001159F6 /* JSBigInt.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		86976E5E1FA3E8B600E7C4E1 /* BigIntPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 86976E5A1FA3758A00E7C4E1 /* BigIntPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -4084,6 +4085,8 @@
> 		86704B8112DBA33700A9FE7B /* YarrParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrParser.h; path = yarr/YarrParser.h; sourceTree = "<group>"; };
> 		86704B8212DBA33700A9FE7B /* YarrPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = YarrPattern.cpp; path = yarr/YarrPattern.cpp; sourceTree = "<group>"; };
> 		86704B8312DBA33700A9FE7B /* YarrPattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = YarrPattern.h; path = yarr/YarrPattern.h; sourceTree = "<group>"; };
>+		8676C6E62346450B00FAAFF3 /* PutByValFlags.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = PutByValFlags.h; sourceTree = "<group>"; };
>+		8676C6E7234645B300FAAFF3 /* PutByValFlags.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = PutByValFlags.cpp; sourceTree = "<group>"; };
> 		86880F1B14328BB900B08D42 /* DFGSpeculativeJIT32_64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSpeculativeJIT32_64.cpp; path = dfg/DFGSpeculativeJIT32_64.cpp; sourceTree = "<group>"; };
> 		86880F4C14353B2100B08D42 /* DFGSpeculativeJIT64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSpeculativeJIT64.cpp; path = dfg/DFGSpeculativeJIT64.cpp; sourceTree = "<group>"; };
> 		868916A9155F285400CB2B9A /* PrivateName.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PrivateName.h; sourceTree = "<group>"; };
>@@ -8282,6 +8285,8 @@
> 				0F93329A14CA7DC10085F3C6 /* PutByIdStatus.h */,
> 				0F93B4A718B92C4D00178A3F /* PutByIdVariant.cpp */,
> 				0F93B4A818B92C4D00178A3F /* PutByIdVariant.h */,
>+				8676C6E7234645B300FAAFF3 /* PutByValFlags.cpp */,
>+				8676C6E62346450B00FAAFF3 /* PutByValFlags.h */,
> 				0F9FC8C114E1B5FB00D52AE0 /* PutKind.h */,
> 				0F44A7AD20BF685F0022B171 /* RecordedStatuses.cpp */,
> 				0F44A7AA20BF685E0022B171 /* RecordedStatuses.h */,
>@@ -10003,6 +10008,7 @@
> 				0F15CD231BA5F9860031FFD3 /* PutByIdFlags.h in Headers */,
> 				0F9332A414CA7DD90085F3C6 /* PutByIdStatus.h in Headers */,
> 				0F93B4AA18B92C4D00178A3F /* PutByIdVariant.h in Headers */,
>+				8676C6E82346467E00FAAFF3 /* PutByValFlags.h in Headers */,
> 				0F0CD4C215F1A6070032F1C0 /* PutDirectIndexMode.h in Headers */,
> 				0F9FC8C514E1B60400D52AE0 /* PutKind.h in Headers */,
> 				147B84630E6DE6B1004775A4 /* PutPropertySlot.h in Headers */,
>diff --git a/Source/JavaScriptCore/Sources.txt b/Source/JavaScriptCore/Sources.txt
>index ec03727ab33fffd121e7a76b1b0671da899ba9cd..848cd2ca27729b9afb70566c76bee51a3fb2db6a 100644
>--- a/Source/JavaScriptCore/Sources.txt
>+++ b/Source/JavaScriptCore/Sources.txt
>@@ -262,6 +262,7 @@ bytecode/ProxyableAccessCase.cpp
> bytecode/PutByIdFlags.cpp
> bytecode/PutByIdStatus.cpp
> bytecode/PutByIdVariant.cpp
>+bytecode/PutByValFlags.cpp
> bytecode/RecordedStatuses.cpp
> bytecode/ReduceWhitespace.cpp
> bytecode/SpeculatedType.cpp
>diff --git a/Source/JavaScriptCore/builtins/BuiltinNames.h b/Source/JavaScriptCore/builtins/BuiltinNames.h
>index eb8ffb78f5520838bf4ae9529425fa86a60f6109..1308363132700bb92fe473a1a8799c1b1cd2e7b4 100644
>--- a/Source/JavaScriptCore/builtins/BuiltinNames.h
>+++ b/Source/JavaScriptCore/builtins/BuiltinNames.h
>@@ -173,7 +173,8 @@ namespace JSC {
>     macro(meta) \
>     macro(webAssemblyCompileStreamingInternal) \
>     macro(webAssemblyInstantiateStreamingInternal) \
>-    macro(instanceFieldInitializer) 
>+    macro(instanceFieldInitializer) \
>+    macro(createPrivateSymbol)
> 
> namespace Symbols {
> #define DECLARE_BUILTIN_STATIC_SYMBOLS(name) extern JS_EXPORT_PRIVATE SymbolImpl::StaticSymbolImpl name##Symbol;
>diff --git a/Source/JavaScriptCore/bytecode/BytecodeDumper.cpp b/Source/JavaScriptCore/bytecode/BytecodeDumper.cpp
>index 7b415492d517a2db4c21d933633d18f97b352bbe..fb290861ee3fab6de6b76847ec8db2673f806633 100644
>--- a/Source/JavaScriptCore/bytecode/BytecodeDumper.cpp
>+++ b/Source/JavaScriptCore/bytecode/BytecodeDumper.cpp
>@@ -38,6 +38,7 @@
> #include "InterpreterInlines.h"
> #include "PolymorphicAccess.h"
> #include "PutByIdFlags.h"
>+#include "PutByValFlags.h"
> #include "StructureInlines.h"
> #include "ToThisStatus.h"
> #include "UnlinkedCodeBlock.h"
>diff --git a/Source/JavaScriptCore/bytecode/BytecodeList.rb b/Source/JavaScriptCore/bytecode/BytecodeList.rb
>index d719fb91ca93fa36d415caf3cfb7b02c78841d23..59dc76c4284426e53a8a2b6618faa9608cde49d1 100644
>--- a/Source/JavaScriptCore/bytecode/BytecodeList.rb
>+++ b/Source/JavaScriptCore/bytecode/BytecodeList.rb
>@@ -47,6 +47,7 @@ types [
>     :ProfileTypeBytecodeFlag,
>     :PropertyOffset,
>     :PutByIdFlags,
>+    :PutByValFlags,
>     :ResolveType,
>     :Structure,
>     :StructureID,
>@@ -538,6 +539,17 @@ op :get_by_val,
>         seenIdentifiers: GetByValHistory,
>     }
> 
>+op :get_by_val_direct,
>+    args: {
>+        dst: VirtualRegister,
>+        base: VirtualRegister,
>+        property: VirtualRegister,
>+    },
>+    metadata: {
>+        profile: ValueProfile,
>+        arrayProfile: ArrayProfile,
>+    }
>+
> op :put_by_val,
>     args: {
>         base: VirtualRegister,
>@@ -561,6 +573,7 @@ op :put_by_val_direct,
>         base: VirtualRegister,
>         property: VirtualRegister,
>         value: VirtualRegister,
>+        flags: PutByValFlags,
>     },
>     metadata: {
>         arrayProfile: ArrayProfile,
>diff --git a/Source/JavaScriptCore/bytecode/BytecodeUseDef.h b/Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>index 01d43aa1748da069ed654612a2cd65cbfc4818f5..b59b169a2370e010ccce089c85e501401ec584b8 100644
>--- a/Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>+++ b/Source/JavaScriptCore/bytecode/BytecodeUseDef.h
>@@ -217,6 +217,7 @@ void computeUsesForBytecodeIndex(Block* codeBlock, const Instruction* instructio
>     USES(OpEnumeratorStructurePname, enumerator, index)
>     USES(OpEnumeratorGenericPname, enumerator, index)
>     USES(OpGetByVal, base, property)
>+    USES(OpGetByValDirect, base, property)
>     USES(OpInByVal, base, property)
>     USES(OpOverridesHasInstance, constructor, hasInstanceValue)
>     USES(OpInstanceof, value, prototype)
>@@ -426,6 +427,7 @@ void computeDefsForBytecodeIndex(Block* codeBlock, const Instruction* instructio
>     DEFS(OpInstanceof, dst)
>     DEFS(OpInstanceofCustom, dst)
>     DEFS(OpGetByVal, dst)
>+    DEFS(OpGetByValDirect, dst)
>     DEFS(OpTypeof, dst)
>     DEFS(OpIdentityWithProfile, srcDst)
>     DEFS(OpIsEmpty, dst)
>diff --git a/Source/JavaScriptCore/bytecode/Fits.h b/Source/JavaScriptCore/bytecode/Fits.h
>index 57789bc2c669f7cad8883decf3513278449c824f..d6385b3bfaf18117dee620c1c1a734e57133f599 100644
>--- a/Source/JavaScriptCore/bytecode/Fits.h
>+++ b/Source/JavaScriptCore/bytecode/Fits.h
>@@ -31,6 +31,7 @@
> #include "OpcodeSize.h"
> #include "ProfileTypeBytecodeFlag.h"
> #include "PutByIdFlags.h"
>+#include "PutByValFlags.h"
> #include "ResultType.h"
> #include "SymbolTableOrScopeDepth.h"
> #include "VirtualRegister.h"
>diff --git a/Source/JavaScriptCore/bytecode/LinkTimeConstant.h b/Source/JavaScriptCore/bytecode/LinkTimeConstant.h
>index 1b6e7262409c857432d4b2fcfacf17c760d17b64..02a6cf048d124a2e9ee0b53402bdfbd824e0c760 100644
>--- a/Source/JavaScriptCore/bytecode/LinkTimeConstant.h
>+++ b/Source/JavaScriptCore/bytecode/LinkTimeConstant.h
>@@ -100,6 +100,7 @@ class JSGlobalObject;
>     v(Array, nullptr) \
>     v(applyFunction, nullptr) \
>     v(callFunction, nullptr) \
>+    v(createPrivateSymbol, nullptr)
> 
> 
> #define DECLARE_LINK_TIME_CONSTANT(name, code) name,
>diff --git a/Source/JavaScriptCore/bytecode/PutByValFlags.cpp b/Source/JavaScriptCore/bytecode/PutByValFlags.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..9e776a8cca8111184728efa60257516a9ed044ba
>--- /dev/null
>+++ b/Source/JavaScriptCore/bytecode/PutByValFlags.cpp
>@@ -0,0 +1,48 @@
>+/*
>+ * Copyright (C) 2019 Apple Inc. All rights reserved.
>+ * Copyright (C) 2019 Igalia S.L.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#include "config.h"
>+#include "PutByValFlags.h"
>+
>+#include <wtf/CommaPrinter.h>
>+#include <wtf/PrintStream.h>
>+#include <wtf/StringPrintStream.h>
>+
>+namespace WTF {
>+
>+using namespace JSC;
>+
>+void printInternal(PrintStream& out, PutByValFlags flags)
>+{
>+    CommaPrinter comma("|");
>+    if (flags & PutByValPrivateName)
>+        out.print(comma, "PrivateName");
>+    if (flags & PutByValThrowIfExists)
>+        out.print(comma, "ThrowIfExists");
>+}
>+
>+} // namespace WTF
>+
>diff --git a/Source/JavaScriptCore/bytecode/PutByValFlags.h b/Source/JavaScriptCore/bytecode/PutByValFlags.h
>new file mode 100644
>index 0000000000000000000000000000000000000000..52895b678607c9a309093372818c0e8ff37faad9
>--- /dev/null
>+++ b/Source/JavaScriptCore/bytecode/PutByValFlags.h
>@@ -0,0 +1,53 @@
>+/*
>+ * Copyright (C) 2019 Apple Inc. All rights reserved.
>+ * Copyright (C) 2019 Igalia S.L.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>+ */
>+
>+#pragma once
>+
>+#include "StructureIDTable.h"
>+
>+namespace JSC {
>+
>+enum PutByValFlags : int32_t {
>+    PutByValNone = 0,
>+
>+    PutByValPrivateName = 1,
>+
>+    PutByValThrowIfExists = 2,
>+
>+    // The PrivateFieldAdd operation must throw if an entry for the private record does not exist
>+    PutByValPrivateFieldAdd = PutByValPrivateName | PutByValThrowIfExists,
>+    PutByValPrivateFieldPut = PutByValPrivateName,
>+};
>+
>+} // namespace JSC
>+
>+namespace WTF {
>+
>+class PrintStream;
>+
>+void printInternal(PrintStream&, JSC::PutByValFlags);
>+
>+} // namespace WTF
>diff --git a/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp b/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp
>index ba9f1a7ef39622351152a345f700b6454e05c697..ba6e050fdbcd5c755fcdaf455e979ed081642e98 100644
>--- a/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp
>+++ b/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp
>@@ -60,7 +60,7 @@ static UnlinkedFunctionCodeBlock* generateUnlinkedFunctionCodeBlock(
>     auto optionalInstanceFieldLocations = executable->instanceFieldLocations();
>     const auto& instanceFieldLocations = optionalInstanceFieldLocations ? *optionalInstanceFieldLocations : Vector<JSTextPosition>();
>     std::unique_ptr<FunctionNode> function = parse<FunctionNode>(
>-        vm, source, executable->name(), builtinMode, strictMode, scriptMode, executable->parseMode(), executable->superBinding(), error, nullptr, ConstructorKind::None, DerivedContextType::None, EvalContextType::None, nullptr, instanceFieldLocations);
>+        vm, source, executable->name(), builtinMode, strictMode, scriptMode, executable->parseMode(), executable->superBinding(), error, nullptr, ConstructorKind::None, DerivedContextType::None, EvalContextType::None, nullptr, nullptr, instanceFieldLocations);
> 
>     if (!function) {
>         ASSERT(error.isValid());
>diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>index b7bad4b70cf0b29b64301b7de871d3944b1e6db1..771f062e233dd1f0b7efd86b8c9d5d31ba8ffdea 100644
>--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
>@@ -1854,6 +1854,10 @@ bool BytecodeGenerator::instantiateLexicalVariables(const VariableEnvironment& l
> 
>             SymbolTableEntry newEntry(varOffset, static_cast<unsigned>(entry.value.isConst() ? PropertyAttribute::ReadOnly : PropertyAttribute::None));
>             symbolTable->add(NoLockingNecessary, entry.key.get(), newEntry);
>+
>+            // FIXME: only do this if there is an eval() within a nested scope --- otherwise it isn't needed.
>+            if (entry.value.isPrivateName())
>+                symbolTable->addPrivateName(entry.key.get());
>         }
>     }
>     return hasCapturedVariables;
>@@ -2641,9 +2645,15 @@ RegisterID* BytecodeGenerator::emitPutByVal(RegisterID* base, RegisterID* thisVa
>     return value;
> }
> 
>+RegisterID* BytecodeGenerator::emitDirectGetByVal(RegisterID* dst, RegisterID* base, RegisterID* property)
>+{
>+    OpGetByValDirect::emit(this, dst, base, property);
>+    return dst;
>+}
>+
> RegisterID* BytecodeGenerator::emitDirectPutByVal(RegisterID* base, RegisterID* property, RegisterID* value)
> {
>-    OpPutByValDirect::emit(this, base, property, value);
>+    OpPutByValDirect::emit(this, base, property, value, PutByValNone);
>     return value;
> }
> 
>@@ -2665,6 +2675,18 @@ RegisterID* BytecodeGenerator::emitPutInternalField(RegisterID* base, unsigned i
>     return value;
> }
> 
>+RegisterID* BytecodeGenerator::emitPrivateFieldAdd(RegisterID* base, RegisterID* property, RegisterID* value)
>+{
>+    OpPutByValDirect::emit(this, base, property, value, PutByValPrivateFieldAdd);
>+    return value;
>+}
>+
>+RegisterID* BytecodeGenerator::emitPrivateFieldPut(RegisterID* base, RegisterID* property, RegisterID* value)
>+{
>+    OpPutByValDirect::emit(this, base, property, value, PutByValPrivateFieldPut);
>+    return value;
>+}
>+
> void BytecodeGenerator::emitSuperSamplerBegin()
> {
>     OpSuperSamplerBegin::emit(this);
>diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>index 4cc098c47a0ef0003fce282d74b09990dfed28d1..4f890714fce817085ee96923aff6557f5c0488ca 100644
>--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
>@@ -781,11 +781,14 @@ namespace JSC {
>         RegisterID* emitGetByVal(RegisterID* dst, RegisterID* base, RegisterID* thisValue, RegisterID* property);
>         RegisterID* emitPutByVal(RegisterID* base, RegisterID* property, RegisterID* value);
>         RegisterID* emitPutByVal(RegisterID* base, RegisterID* thisValue, RegisterID* property, RegisterID* value);
>+        RegisterID* emitDirectGetByVal(RegisterID* dst, RegisterID* base, RegisterID* property);
>         RegisterID* emitDirectPutByVal(RegisterID* base, RegisterID* property, RegisterID* value);
>         RegisterID* emitDeleteByVal(RegisterID* dst, RegisterID* base, RegisterID* property);
> 
>         RegisterID* emitGetInternalField(RegisterID* dst, RegisterID* base, unsigned index);
>         RegisterID* emitPutInternalField(RegisterID* base, unsigned index, RegisterID* value);
>+        RegisterID* emitPrivateFieldAdd(RegisterID* base, RegisterID* property, RegisterID* value);
>+        RegisterID* emitPrivateFieldPut(RegisterID* base, RegisterID* property, RegisterID* value);
> 
>         void emitSuperSamplerBegin();
>         void emitSuperSamplerEnd();
>diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>index 540f22863ab68fdc4dfd7a7c25f67b6ce4f04c3e..dd0b760a5455156f71af5670612f7fb7345cf8d7 100644
>--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
>@@ -541,9 +541,19 @@ static inline void emitPutHomeObject(BytecodeGenerator& generator, RegisterID* f
> 
> RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dstOrConstructor, RegisterID* prototype, Vector<JSTextPosition>* instanceFieldLocations)
> {
>-    // Fast case: this loop just handles regular value properties.
>+    // PrivateNames are hoisted and we need to declare them before computed properties are handled.
>     PropertyListNode* p = this;
>     RegisterID* dst = nullptr;
>+    for (; p; p = p->m_next) {
>+        if (!(p->m_node->m_type & PropertyNode::Private))
>+            continue;
>+
>+        dst = p->m_node->isInstanceClassProperty() ? prototype : dstOrConstructor;
>+        emitPutConstantProperty(generator, dst, *p->m_node);
>+    }
>+ 
>+    // Fast case: this loop just handles regular value properties.
>+    p = this;
>     for (; p && (p->m_node->m_type & PropertyNode::Constant); p = p->m_next) {
>         dst = p->m_node->isInstanceClassProperty() ? prototype : dstOrConstructor;
> 
>@@ -702,6 +712,18 @@ RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, Registe
> 
> void PropertyListNode::emitPutConstantProperty(BytecodeGenerator& generator, RegisterID* newObj, PropertyNode& node)
> {
>+    if (node.type() & PropertyNode::Private) {
>+        RefPtr<RegisterID> createPrivateSymbol = generator.moveLinkTimeConstant(nullptr, LinkTimeConstant::createPrivateSymbol);
>+
>+        CallArguments arguments(generator, nullptr, 0);
>+        generator.emitLoad(arguments.thisRegister(), jsUndefined());
>+        RegisterID* symbol = generator.emitCall(generator.finalDestination(nullptr, createPrivateSymbol.get()), createPrivateSymbol.get(), NoExpectedFunction, arguments, position(), position(), position(), DebuggableCall::No);
>+
>+        Variable var = generator.variable(*node.name());
>+        generator.emitPutToScope(generator.scopeRegister(), var, symbol, DoNotThrowIfNotFound, InitializationMode::ConstInitialization);
>+        return;
>+    }
>+
>     RefPtr<RegisterID> value = generator.emitNode(node.m_assign);
>     if (node.needsSuperBinding())
>         emitPutHomeObject(generator, value.get(), newObj);
>@@ -819,16 +841,68 @@ RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, Register
>     }
> 
>     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>-    RegisterID* ret;
>-    if (baseIsSuper) {
>-        RefPtr<RegisterID> thisValue = generator.ensureThis();
>-        ret = generator.emitGetById(finalDest.get(), base.get(), thisValue.get(), m_ident);
>-    } else
>-        ret = generator.emitGetById(finalDest.get(), base.get(), m_ident);
>+    RegisterID* ret = emitGetPropertyValue(generator, finalDest.get(), base.get());
>+
>     generator.emitProfileType(finalDest.get(), divotStart(), divotEnd());
>     return ret;
> }
> 
>+RegisterID* BaseDotNode::emitGetPropertyValue(BytecodeGenerator& generator, RegisterID* dst, RegisterID* base, RefPtr<RegisterID>& thisValue)
>+{
>+    if (isPrivateName()) {
>+        Variable var = generator.variable(m_ident);
>+        ASSERT_WITH_MESSAGE(!var.local(), "Private Field names must be stored in captured variables");
>+
>+        RefPtr<RegisterID> scope = generator.emitResolveScope(generator.newTemporary(), var);
>+        RefPtr<RegisterID> privateName = generator.newTemporary();
>+        generator.emitGetFromScope(privateName.get(), scope.get(), var, DoNotThrowIfNotFound);
>+        generator.emitProfileType(privateName.get(), var, m_position, JSTextPosition(-1, m_position.offset, m_ident.length()));
>+        return generator.emitDirectGetByVal(dst, base, privateName.get());
>+    }
>+
>+    if (m_base->isSuperNode()) {
>+        if (!thisValue)
>+            thisValue = generator.ensureThis();
>+        return generator.emitGetById(dst, base, thisValue.get(), m_ident);
>+    }
>+
>+    return generator.emitGetById(dst, base, m_ident);
>+}
>+
>+RegisterID* BaseDotNode::emitGetPropertyValue(BytecodeGenerator& generator, RegisterID* dst, RegisterID* base)
>+{
>+    RefPtr<RegisterID> thisValue;
>+    return emitGetPropertyValue(generator, dst, base, thisValue);
>+}
>+
>+RegisterID* BaseDotNode::emitPutProperty(BytecodeGenerator& generator, RegisterID* base, RegisterID* value, RefPtr<RegisterID>& thisValue)
>+{
>+    if (isPrivateName()) {
>+        Variable var = generator.variable(m_ident);
>+        ASSERT_WITH_MESSAGE(!var.local(), "Private Field names must be stored in captured variables");
>+
>+        RefPtr<RegisterID> scope = generator.emitResolveScope(generator.newTemporary(), var);
>+        RefPtr<RegisterID> privateName = generator.newTemporary();
>+        generator.emitGetFromScope(privateName.get(), scope.get(), var, DoNotThrowIfNotFound);
>+        generator.emitProfileType(privateName.get(), var, m_position, JSTextPosition(-1, m_position.offset, m_ident.length()));
>+        return generator.emitPrivateFieldPut(base, privateName.get(), value);
>+    }
>+
>+    if (m_base->isSuperNode()) {
>+        if (!thisValue)
>+            thisValue = generator.ensureThis();
>+        return generator.emitPutById(base, thisValue.get(), m_ident, value);
>+    }
>+
>+    return generator.emitPutById(base, m_ident, value);
>+}
>+
>+RegisterID* BaseDotNode::emitPutProperty(BytecodeGenerator& generator, RegisterID* base, RegisterID* value)
>+{
>+    RefPtr<RegisterID> thisValue;
>+    return emitPutProperty(generator, base, value, thisValue);
>+}
>+
> // ------------------------------ ArgumentListNode -----------------------------
> 
> RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
>@@ -1601,11 +1675,9 @@ RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, Regi
>             generator.emitOptionalCheck(callArguments.thisRegister());
>     }
>     generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
>-    if (baseIsSuper) {
>-        RefPtr<RegisterID> superBase = emitSuperBaseForCallee(generator);
>-        generator.emitGetById(function.get(), superBase.get(), callArguments.thisRegister(), m_ident);
>-    } else
>-        generator.emitGetById(function.get(), callArguments.thisRegister(), m_ident);
>+
>+    RefPtr<RegisterID> base = baseIsSuper ? emitSuperBaseForCallee(generator) : callArguments.thisRegister();
>+    emitGetPropertyValue(generator, function.get(), base.get());
> 
>     if (isOptionalChainBase())
>         generator.emitOptionalCheck(function.get());
>@@ -1926,6 +1998,23 @@ RegisterID* PostfixNode::emitDot(BytecodeGenerator& generator, RegisterID* dst)
>     RefPtr<RegisterID> base = generator.emitNode(baseNode);
> 
>     generator.emitExpressionInfo(dotAccessor->divot(), dotAccessor->divotStart(), dotAccessor->divotEnd());
>+
>+    if (dotAccessor->isPrivateName()) {
>+        ASSERT(!baseIsSuper);
>+        Variable var = generator.variable(ident);
>+        RefPtr<RegisterID> scope = generator.emitResolveScope(generator.newTemporary(), var);
>+        RefPtr<RegisterID> privateName = generator.newTemporary();
>+        generator.emitGetFromScope(privateName.get(), scope.get(), var, DoNotThrowIfNotFound);
>+        generator.emitProfileType(privateName.get(), var, m_position, JSTextPosition(-1, m_position.offset + ident.length(), -1));
>+
>+        RefPtr<RegisterID> value = generator.emitDirectGetByVal(generator.newTemporary(), base.get(), privateName.get());
>+        RegisterID* oldValue = emitPostIncOrDec(generator, generator.tempDestination(dst), value.get(), m_operator);
>+        generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>+        generator.emitPrivateFieldPut(base.get(), privateName.get(), value.get());
>+        generator.emitProfileType(value.get(), divotStart(), divotEnd());
>+        return generator.move(dst, oldValue);
>+    }
>+
>     RefPtr<RegisterID> value;
>     RefPtr<RegisterID> thisValue;
>     if (baseIsSuper) {
>@@ -2149,6 +2238,22 @@ RegisterID* PrefixNode::emitDot(BytecodeGenerator& generator, RegisterID* dst)
> 
>     generator.emitExpressionInfo(dotAccessor->divot(), dotAccessor->divotStart(), dotAccessor->divotEnd());
>     RegisterID* value;
>+    if (dotAccessor->isPrivateName()) {
>+        ASSERT(!baseNode->isSuperNode());
>+        Variable var = generator.variable(ident);
>+        RefPtr<RegisterID> scope = generator.emitResolveScope(generator.newTemporary(), var);
>+        RefPtr<RegisterID> privateName = generator.newTemporary();
>+        generator.emitGetFromScope(privateName.get(), scope.get(), var, DoNotThrowIfNotFound);
>+        generator.emitProfileType(privateName.get(), var, m_position, JSTextPosition(-1, m_position.offset + ident.length(), -1));
>+
>+        value = generator.emitDirectGetByVal(propDst.get(), base.get(), privateName.get());
>+        emitIncOrDec(generator, value, m_operator);
>+        generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>+        generator.emitPrivateFieldPut(base.get(), privateName.get(), value);
>+        generator.emitProfileType(value, divotStart(), divotEnd());
>+        return generator.move(dst, propDst.get());
>+    }
>+
>     RefPtr<RegisterID> thisValue;
>     if (baseNode->isSuperNode()) {
>         thisValue = generator.ensureThis();
>@@ -2885,11 +2990,7 @@ RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
>     RefPtr<RegisterID> result = generator.emitNode(value.get(), m_right);
>     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>     RefPtr<RegisterID> forwardResult = (dst == generator.ignoredResult()) ? result.get() : generator.move(generator.tempDestination(result.get()), result.get());
>-    if (m_base->isSuperNode()) {
>-        RefPtr<RegisterID> thisValue = generator.ensureThis();
>-        generator.emitPutById(base.get(), thisValue.get(), m_ident, forwardResult.get());
>-    } else
>-        generator.emitPutById(base.get(), m_ident, forwardResult.get());
>+    emitPutProperty(generator, base.get(), forwardResult.get());
>     generator.emitProfileType(forwardResult.get(), divotStart(), divotEnd());
>     return generator.move(dst, forwardResult.get());
> }
>@@ -2901,21 +3002,13 @@ RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, Regist
>     RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
> 
>     generator.emitExpressionInfo(subexpressionDivot(), subexpressionStart(), subexpressionEnd());
>-    RefPtr<RegisterID> value;
>     RefPtr<RegisterID> thisValue;
>-    if (m_base->isSuperNode()) {
>-        thisValue = generator.ensureThis();
>-        value = generator.emitGetById(generator.tempDestination(dst), base.get(), thisValue.get(), m_ident);
>-    } else
>-        value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
>+    RefPtr<RegisterID> value = emitGetPropertyValue(generator, generator.tempDestination(dst), base.get(), thisValue);
>+
>     RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, static_cast<JSC::Operator>(m_operator), OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
> 
>     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
>-    RegisterID* ret;
>-    if (m_base->isSuperNode())
>-        ret = generator.emitPutById(base.get(), thisValue.get(), m_ident, updatedValue);
>-    else
>-        ret = generator.emitPutById(base.get(), m_ident, updatedValue);
>+    RegisterID* ret = emitPutProperty(generator, base.get(), updatedValue, thisValue);
>     generator.emitProfileType(updatedValue, divotStart(), divotEnd());
>     return ret;
> }
>@@ -4313,6 +4406,18 @@ void DefineFieldNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
>         generator.emitCallDefineProperty(generator.thisRegister(), propertyName.get(), value.get(), nullptr, nullptr, BytecodeGenerator::PropertyConfigurable | BytecodeGenerator::PropertyWritable | BytecodeGenerator::PropertyEnumerable, m_position);
>         break;
>     }
>+    case DefineFieldNode::Type::PrivateName: {
>+        Variable var = generator.variable(*m_ident);
>+        ASSERT_WITH_MESSAGE(!var.local(), "Private Field names must be stored in captured variables");
>+
>+        generator.emitExpressionInfo(position(), position(), position() + m_ident->length());
>+        RefPtr<RegisterID> scope = generator.emitResolveScope(generator.newTemporary(), var);
>+        RefPtr<RegisterID> privateName = generator.newTemporary();
>+        generator.emitGetFromScope(privateName.get(), scope.get(), var, DoNotThrowIfNotFound);
>+        generator.emitProfileType(privateName.get(), var, m_position, JSTextPosition(-1, m_position.offset + m_ident->length(), -1));
>+        generator.emitPrivateFieldAdd(generator.thisRegister(), privateName.get(), value.get());
>+        break;
>+    }
>     case DefineFieldNode::Type::ComputedName: {
>         // FIXME: Improve performance of public class fields
>         // https://bugs.webkit.org/show_bug.cgi?id=198330
>diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>index 79cd4ad356ff8a83169cabdc08eec0d3f5f1b27c..7b1195f4404a2f612dead7db610eac489c34b3a4 100644
>--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
>@@ -66,6 +66,7 @@
> #include "PreciseJumpTargets.h"
> #include "PutByIdFlags.h"
> #include "PutByIdStatus.h"
>+#include "PutByValFlags.h"
> #include "RegExpPrototype.h"
> #include "StackAlignment.h"
> #include "StringConstructor.h"
>diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.cpp b/Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>index cdc4826e0318993b3d8531ab39f70362437e6057..5e19a487b4c3fff6c49c1561856eb24d018a3717 100644
>--- a/Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.cpp
>@@ -293,6 +293,7 @@ CapabilityLevel capabilityLevel(OpcodeID opcodeID, CodeBlock* codeBlock, const I
>     case op_yield:
>     case op_create_generator_frame_environment:
>     case op_to_property_key:
>+    case op_get_by_val_direct:
>     case llint_program_prologue:
>     case llint_eval_prologue:
>     case llint_module_program_prologue:
>diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>index f6a1cf561b82f29415aba4f24db8fa83d31dd7f9..0290bbd1cd8fb0e55a0c27f4fab3ebd19afb7b74 100644
>--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
>@@ -13703,7 +13703,7 @@ void SpeculativeJIT::cachedPutById(CodeOrigin codeOrigin, GPRReg baseGPR, JSValu
>     JITPutByIdGenerator gen(
>         m_jit.codeBlock(), codeOrigin, callSite, usedRegisters,
>         JSValueRegs::payloadOnly(baseGPR), valueRegs,
>-        scratchGPR, m_jit.ecmaModeFor(codeOrigin), putKind);
>+        scratchGPR, m_jit.ecmaModeFor(codeOrigin), putKind, PutByValNone);
> 
>     gen.generateFastPath(m_jit);
> 
>diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>index 4f3504343dacecbf676f93a5794faa8b2c5d447e..25323c2b1e383e0d5661d77e79fd7f970b75ec74 100644
>--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
>@@ -3948,7 +3948,7 @@ private:
>                     jit.codeBlock(), node->origin.semantic, callSiteIndex,
>                     params.unavailableRegisters(), JSValueRegs(params[0].gpr()),
>                     JSValueRegs(params[1].gpr()), GPRInfo::patchpointScratchRegister, ecmaMode,
>-                    node->op() == PutByIdDirect ? Direct : NotDirect);
>+                    node->op() == PutByIdDirect ? Direct : NotDirect, PutByValNone);
> 
>                 generator->generateFastPath(jit);
>                 CCallHelpers::Label done = jit.label();
>diff --git a/Source/JavaScriptCore/generator/DSL.rb b/Source/JavaScriptCore/generator/DSL.rb
>index a78b19d372c05a51d6ef583213d92cdb17848972..deee4187174ccc60c4ced313d813291d92ba6ddd 100644
>--- a/Source/JavaScriptCore/generator/DSL.rb
>+++ b/Source/JavaScriptCore/generator/DSL.rb
>@@ -141,6 +141,7 @@ module DSL
> #include "Opcode.h"
> #include "PutByIdStatus.h"
> #include "PutByIdFlags.h"
>+#include "PutByValFlags.h"
> #include "ToThisStatus.h"
> 
> namespace JSC {
>diff --git a/Source/JavaScriptCore/jit/ICStats.h b/Source/JavaScriptCore/jit/ICStats.h
>index 5d30928f4a85b4ade444c43f5addf2317f4265b7..cb48adfff16db63241c250d97282dda65544956c 100644
>--- a/Source/JavaScriptCore/jit/ICStats.h
>+++ b/Source/JavaScriptCore/jit/ICStats.h
>@@ -67,6 +67,8 @@ namespace JSC {
>     macro(OperationPutByIdNonStrictBuildList) \
>     macro(OperationPutByIdDirectStrictBuildList) \
>     macro(OperationPutByIdDirectNonStrictBuildList) \
>+    macro(OperationPutByIdAddPrivateFieldStrictOptimize) \
>+    macro(OperationPutByIdPutPrivateFieldStrictOptimize) \
>     macro(PutByIdAddAccessCase) \
>     macro(PutByIdReplaceWithJump) \
>     macro(PutByIdSelfPatch) \
>diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
>index 4140c9d47676b1dd30ec34e53a5b123ca3a2be9e..44a31e45a6a927ee209e9bf44566502da3a947b6 100644
>--- a/Source/JavaScriptCore/jit/JIT.cpp
>+++ b/Source/JavaScriptCore/jit/JIT.cpp
>@@ -290,6 +290,7 @@ void JIT::privateCompileMainPass()
>         DEFINE_SLOW_OP(push_with_scope)
>         DEFINE_SLOW_OP(create_lexical_environment)
>         DEFINE_SLOW_OP(get_by_val_with_this)
>+        DEFINE_SLOW_OP(get_by_val_direct)
>         DEFINE_SLOW_OP(put_by_id_with_this)
>         DEFINE_SLOW_OP(put_by_val_with_this)
>         DEFINE_SLOW_OP(resolve_scope_for_hoisting_func_decl_in_eval)
>diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
>index b3147f2f6769c986a7ae3533f27dba906cd27eb6..e86f2af8f3bb69a0263cbd8c083a608c9337355c 100644
>--- a/Source/JavaScriptCore/jit/JIT.h
>+++ b/Source/JavaScriptCore/jit/JIT.h
>@@ -396,6 +396,9 @@ namespace JSC {
>         template<typename Op>
>         JumpList emitFloatTypedArrayPutByVal(Op, PatchableJump& badType, TypedArrayType);
> 
>+        template<typename Op>
>+        PutByValFlags putByValFlags(Op);
>+
>         // Identifier check helper for GetByVal and PutByVal.
>         void emitByValIdentifierCheck(ByValInfo*, RegisterID cell, RegisterID scratch, const Identifier&, JumpList& slowCases);
> 
>diff --git a/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp b/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp
>index cd6aa31766cd6866f0d5a6ec3806db8d9d72d52e..2c41d4e920cfbda10e5b1d4f38dec51ae7f152ad 100644
>--- a/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp
>+++ b/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp
>@@ -136,11 +136,12 @@ void JITGetByIdWithThisGenerator::generateFastPath(MacroAssembler& jit)
> JITPutByIdGenerator::JITPutByIdGenerator(
>     CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, const RegisterSet& usedRegisters,
>     JSValueRegs base, JSValueRegs value, GPRReg scratch, 
>-    ECMAMode ecmaMode, PutKind putKind)
>+    ECMAMode ecmaMode, PutKind putKind, PutByValFlags flags)
>     : JITByIdGenerator(
>         codeBlock, codeOrigin, callSite, AccessType::Put, usedRegisters, base, value)
>     , m_ecmaMode(ecmaMode)
>     , m_putKind(putKind)
>+    , m_flags(flags)
> {
>     m_stubInfo->patch.usedRegisters.clear(scratch);
> }
>@@ -152,6 +153,14 @@ void JITPutByIdGenerator::generateFastPath(MacroAssembler& jit)
> 
> V_JITOperation_GSsiJJI JITPutByIdGenerator::slowPathFunction()
> {
>+    if (UNLIKELY(m_flags & PutByValPrivateName)) {
>+        ASSERT(m_putKind == Direct);
>+        ASSERT(m_ecmaMode == StrictMode);
>+        if (m_flags & PutByValThrowIfExists)
>+            return operationPutByIdAddPrivateStrictOptimize;
>+        return operationPutByIdPutPrivateStrictOptimize;
>+    }
>+
>     if (m_ecmaMode == StrictMode) {
>         if (m_putKind == Direct)
>             return operationPutByIdDirectStrictOptimize;
>diff --git a/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h b/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h
>index bfb90216b29c27ffd0ed8d7f0f587e08fe6e7316..148f1bc9bf0d3b612329c3454e408cd61e023d0d 100644
>--- a/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h
>+++ b/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h
>@@ -30,6 +30,7 @@
> #include "CodeOrigin.h"
> #include "JITOperations.h"
> #include "JSCJSValue.h"
>+#include "PutByValFlags.h"
> #include "PutKind.h"
> #include "RegisterSet.h"
> 
>@@ -131,7 +132,7 @@ public:
> 
>     JITPutByIdGenerator(
>         CodeBlock*, CodeOrigin, CallSiteIndex, const RegisterSet& usedRegisters, JSValueRegs base,
>-        JSValueRegs value, GPRReg scratch, ECMAMode, PutKind);
>+        JSValueRegs value, GPRReg scratch, ECMAMode, PutKind, PutByValFlags);
>     
>     void generateFastPath(MacroAssembler&);
>     
>@@ -140,6 +141,7 @@ public:
> private:
>     ECMAMode m_ecmaMode;
>     PutKind m_putKind;
>+    PutByValFlags m_flags;
> };
> 
> class JITInByIdGenerator : public JITByIdGenerator {
>diff --git a/Source/JavaScriptCore/jit/JITInlines.h b/Source/JavaScriptCore/jit/JITInlines.h
>index 22149c9bd1b8ec11812cbe0b8541bee93b10ab34..66c42c1dcd913c2dce289e00c96acc26ea448bb7 100644
>--- a/Source/JavaScriptCore/jit/JITInlines.h
>+++ b/Source/JavaScriptCore/jit/JITInlines.h
>@@ -712,6 +712,18 @@ ALWAYS_INLINE BinaryArithProfile JIT::copiedArithProfile(BinaryOp bytecode)
>     return arithProfile;
> }
> 
>+template<typename Op>
>+ALWAYS_INLINE PutByValFlags JIT::putByValFlags(Op)
>+{
>+    return PutByValNone;
>+}
>+
>+template<>
>+ALWAYS_INLINE PutByValFlags JIT::putByValFlags<OpPutByValDirect>(OpPutByValDirect op)
>+{
>+    return op.m_flags;
>+}
>+
> } // namespace JSC
> 
> #endif // ENABLE(JIT)
>diff --git a/Source/JavaScriptCore/jit/JITOperations.cpp b/Source/JavaScriptCore/jit/JITOperations.cpp
>index 3b4850fab8d6fae930e9e8693c44bbf4a1e4393d..2270a7ea103b9d2e5f902b25ce8146ebb60957cc 100644
>--- a/Source/JavaScriptCore/jit/JITOperations.cpp
>+++ b/Source/JavaScriptCore/jit/JITOperations.cpp
>@@ -677,6 +677,82 @@ void JIT_OPERATION operationPutByIdDirectNonStrictOptimize(JSGlobalObject* globa
>         repatchPutByID(globalObject, codeBlock, baseObject, structure, ident, slot, *stubInfo, Direct);
> }
> 
>+void JIT_OPERATION operationPutByIdAddPrivateStrictOptimize(JSGlobalObject* globalObject, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
>+{
>+    SuperSamplerScope superSamplerScope(false);
>+
>+    VM& vm = globalObject->vm();
>+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
>+    NativeCallFrameTracer tracer(vm, callFrame);
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>+    Identifier ident = Identifier::fromUid(vm, uid);
>+    ASSERT(ident.isPrivateName());
>+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
>+
>+    JSValue value = JSValue::decode(encodedValue);
>+    JSObject* baseObject = asObject(JSValue::decode(encodedBase));
>+    CodeBlock* codeBlock = callFrame->codeBlock();
>+
>+    // Throw a TypeError if attempting to store to a non-existent private field. This is similar to a TDZ-like behaviour.
>+    PropertySlot slot(baseObject, PropertySlot::InternalMethodType::VMInquiry);
>+    if (JSObject::getOwnPropertySlot(baseObject, globalObject, ident, slot))
>+        throwException(globalObject, scope, createRedefinedPrivateNameError(globalObject));
>+    RETURN_IF_EXCEPTION(scope, void());
>+
>+    PutPropertySlot putSlot(baseObject, true, codeBlock->putByIdContext());
>+    Structure* structure = nullptr;
>+    CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, ident, value, putSlot, &structure);
>+
>+    LOG_IC((ICEvent::OperationPutByIdAddPrivateFieldStrictOptimize, baseObject->classInfo(vm), ident, putSlot.base() == baseObject));
>+
>+    RETURN_IF_EXCEPTION(scope, void());
>+
>+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
>+        return;
>+
>+    if (stubInfo->considerCaching(vm, codeBlock, structure))
>+        repatchPutByID(globalObject, codeBlock, baseObject, structure, ident, putSlot, *stubInfo, Direct);
>+}
>+
>+void JIT_OPERATION operationPutByIdPutPrivateStrictOptimize(JSGlobalObject* globalObject, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
>+{
>+    SuperSamplerScope superSamplerScope(false);
>+
>+    VM& vm = globalObject->vm();
>+    CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
>+    NativeCallFrameTracer tracer(vm, callFrame);
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>+    Identifier ident = Identifier::fromUid(vm, uid);
>+    ASSERT(ident.isPrivateName());
>+    AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
>+
>+    JSValue value = JSValue::decode(encodedValue);
>+    JSObject* baseObject = asObject(JSValue::decode(encodedBase));
>+    CodeBlock* codeBlock = callFrame->codeBlock();
>+
>+    // Throw a TypeError if attempting to store to a non-existent private field. This is similar to a TDZ-like behaviour.
>+    PropertySlot slot(baseObject, PropertySlot::InternalMethodType::VMInquiry);
>+    if (!JSObject::getOwnPropertySlot(baseObject, globalObject, ident, slot))
>+        throwException(globalObject, scope, createInvalidPrivateNameError(globalObject));
>+    RETURN_IF_EXCEPTION(scope, void());
>+
>+    PutPropertySlot putSlot(baseObject, true, codeBlock->putByIdContext());
>+    Structure* structure = nullptr;
>+    CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, ident, value, putSlot, &structure);
>+
>+    LOG_IC((ICEvent::OperationPutByIdPutPrivateFieldStrictOptimize, baseObject->classInfo(vm), ident, putSlot.base() == baseObject));
>+
>+    RETURN_IF_EXCEPTION(scope, void());
>+
>+    if (accessType != static_cast<AccessType>(stubInfo->accessType))
>+        return;
>+
>+    if (stubInfo->considerCaching(vm, codeBlock, structure))
>+        repatchPutByID(globalObject, codeBlock, baseObject, structure, ident, putSlot, *stubInfo, Direct);
>+}
>+
> ALWAYS_INLINE static bool isStringOrSymbol(JSValue value)
> {
>     return value.isString() || value.isSymbol();
>@@ -780,6 +856,16 @@ static void directPutByVal(JSGlobalObject* globalObject, CodeBlock* codeBlock, J
> 
>     scope.release();
>     PutPropertySlot slot(baseObject, isStrictMode);
>+    if (property.isPrivateName()) {
>+        // Throw a TypeError if attempting to store to a non-existent private field. This is similar to a TDZ-like behaviour.
>+        auto bytecode = codeBlock->instructions().at(byValInfo->bytecodeIndex)->as<OpPutByValDirect>();
>+        PropertySlot slot(baseObject, PropertySlot::InternalMethodType::VMInquiry);
>+        bool found = JSObject::getOwnPropertySlot(baseObject, globalObject, property, slot);
>+        if (found == (bytecode.m_flags & PutByValThrowIfExists)) {
>+            throwException(globalObject, scope, found ? createRedefinedPrivateNameError(globalObject) : createInvalidPrivateNameError(globalObject));
>+            return;
>+        }
>+    }
>     CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, property, value, slot);
> }
> 
>diff --git a/Source/JavaScriptCore/jit/JITOperations.h b/Source/JavaScriptCore/jit/JITOperations.h
>index 6210c5a073419683d60ea8c48cd43eeff82a300c..17fc8b12e81dd49abbb5ce15beb7543c1bd09b74 100644
>--- a/Source/JavaScriptCore/jit/JITOperations.h
>+++ b/Source/JavaScriptCore/jit/JITOperations.h
>@@ -188,6 +188,8 @@ void JIT_OPERATION operationPutByIdStrictBuildList(JSGlobalObject*, StructureStu
> void JIT_OPERATION operationPutByIdNonStrictBuildList(JSGlobalObject*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
> void JIT_OPERATION operationPutByIdDirectStrictBuildList(JSGlobalObject*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
> void JIT_OPERATION operationPutByIdDirectNonStrictBuildList(JSGlobalObject*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
>+void JIT_OPERATION operationPutByIdAddPrivateStrictOptimize(JSGlobalObject*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
>+void JIT_OPERATION operationPutByIdPutPrivateStrictOptimize(JSGlobalObject*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
> void JIT_OPERATION operationPutByValOptimize(JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
> void JIT_OPERATION operationDirectPutByValOptimize(JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
> void JIT_OPERATION operationPutByValGeneric(JSGlobalObject*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
>diff --git a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
>index ab99fd987b061f2e76a17c28be8c4e7265a2d815..0991b0f3c7e8904d77388938222065b42c10ac87 100644
>--- a/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
>+++ b/Source/JavaScriptCore/jit/JITPropertyAccess.cpp
>@@ -286,7 +286,7 @@ JITPutByIdGenerator JIT::emitPutByValWithCachedId(ByValInfo* byValInfo, Op bytec
> 
>     JITPutByIdGenerator gen(
>         m_codeBlock, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),
>-        JSValueRegs(regT0), JSValueRegs(regT1), regT2, m_codeBlock->ecmaMode(), putKind);
>+        JSValueRegs(regT0), JSValueRegs(regT1), regT2, m_codeBlock->ecmaMode(), putKind, putByValFlags(bytecode));
>     gen.generateFastPath(*this);
>     emitWriteBarrier(base, value, ShouldFilterBase);
>     doneCases.append(jump());
>@@ -586,7 +586,7 @@ void JIT::emit_op_put_by_id(const Instruction* currentInstruction)
>     JITPutByIdGenerator gen(
>         m_codeBlock, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),
>         JSValueRegs(regT0), JSValueRegs(regT1), regT2, m_codeBlock->ecmaMode(),
>-        direct ? Direct : NotDirect);
>+        direct ? Direct : NotDirect, PutByValNone);
>     
>     gen.generateFastPath(*this);
>     addSlowCase(gen.slowPathJump());
>diff --git a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
>index 7125bd4f51af815b9d50661eb7a3c241a5ad603b..7568d236d3afb5fc14a6387451876f8992f9467e 100644
>--- a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
>+++ b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
>@@ -59,6 +59,7 @@
> #include "NativeExecutable.h"
> #include "PutByIdFlags.h"
> #include "ProtoCallFrame.h"
>+#include "PutByValFlags.h"
> #include "ShadowChicken.h"
> #include "Structure.h"
> #include "StructureChain.h"
>diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>index 7316e95bd0ab57b9f45884ecdc3bffddc4f6d351..2de868f5caa9b318fa5a6211027b1dde98297d38 100644
>--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>@@ -1053,14 +1053,17 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_val_direct)
>     RELEASE_ASSERT(baseValue.isObject());
>     JSObject* baseObject = asObject(baseValue);
>     bool isStrictMode = codeBlock->isStrictMode();
>+    bool isPrivateNameAccess = bytecode.m_flags & PutByValPrivateName;
>     if (LIKELY(subscript.isUInt32())) {
>         // Despite its name, JSValue::isUInt32 will return true only for positive boxed int32_t; all those values are valid array indices.
>         ASSERT(isIndex(subscript.asUInt32()));
>+        ASSERT(!isPrivateNameAccess);
>         baseObject->putDirectIndex(globalObject, subscript.asUInt32(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
>         LLINT_END();
>     }
> 
>     if (subscript.isDouble()) {
>+        ASSERT(!isPrivateNameAccess);
>         double subscriptAsDouble = subscript.asDouble();
>         uint32_t subscriptAsUInt32 = static_cast<uint32_t>(subscriptAsDouble);
>         if (subscriptAsDouble == subscriptAsUInt32 && isIndex(subscriptAsUInt32)) {
>@@ -1074,9 +1077,18 @@ LLINT_SLOW_PATH_DECL(slow_path_put_by_val_direct)
>     if (UNLIKELY(throwScope.exception()))
>         LLINT_END();
> 
>+    ASSERT(property.isPrivateName() == isPrivateNameAccess);
>     if (Optional<uint32_t> index = parseIndex(property))
>         baseObject->putDirectIndex(globalObject, index.value(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
>     else {
>+        if (isPrivateNameAccess) {
>+            ASSERT(property.isPrivateName());
>+            // Throw a TypeError if attempting to store to a non-existent private field. This is similar to a TDZ-like behaviour.
>+            PropertySlot slot(baseObject, PropertySlot::InternalMethodType::VMInquiry);
>+            bool found = JSObject::getOwnPropertySlot(baseObject, globalObject, property, slot);
>+            if (found == bool(bytecode.m_flags & PutByValThrowIfExists))
>+                LLINT_THROW(found ? createRedefinedPrivateNameError(globalObject) : createInvalidPrivateNameError(globalObject));
>+        }
>         PutPropertySlot slot(baseObject, isStrictMode);
>         CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, property, value, slot);
>     }
>diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>index d401f1206fb3b0975955e10d50605f70ea11dda2..61202c3132f62a08dca2222d8517fc44221cae8b 100644
>--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>@@ -1497,64 +1497,69 @@ llintOpWithMetadata(op_put_by_id, OpPutById, macro (size, get, dispatch, metadat
> 
> end)
> 
>+macro getByValOp(opcodeName, opcodeStruct, slowPathName, osrExitPoint)
>+    llintOpWithMetadata(op_%opcodeName%, %opcodeStruct%, macro (size, get, dispatch, metadata, return)
>+        metadata(t5, t2)
>+        get(m_base, t2)
>+        loadConstantOrVariablePayload(size, t2, CellTag, t0, .opGetByValSlow)
>+        move t0, t2
>+        arrayProfile(%opcodeStruct%::Metadata::m_arrayProfile, t2, t5, t1)
>+        get(m_property, t3)
>+        loadConstantOrVariablePayload(size, t3, Int32Tag, t1, .opGetByValSlow)
>+        loadp JSObject::m_butterfly[t0], t3
>+        andi IndexingShapeMask, t2
>+        bieq t2, Int32Shape, .opGetByValIsContiguous
>+        bineq t2, ContiguousShape, .opGetByValNotContiguous
>+
>+    .opGetByValIsContiguous:
>+        biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>+        loadi TagOffset[t3, t1, 8], t2
>+        loadi PayloadOffset[t3, t1, 8], t1
>+        jmp .opGetByValDone
>+
>+    .opGetByValNotContiguous:
>+        bineq t2, DoubleShape, .opGetByValNotDouble
>+        biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>+        loadd [t3, t1, 8], ft0
>+        bdnequn ft0, ft0, .opGetByValSlow
>+        # FIXME: This could be massively optimized.
>+        fd2ii ft0, t1, t2
>+        get(m_dst, t0)
>+        jmp .opGetByValNotEmpty
>+
>+    .opGetByValNotDouble:
>+        subi ArrayStorageShape, t2
>+        bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValSlow
>+        biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t3], .opGetByValSlow
>+        loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2
>+        loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1
>+
>+    .opGetByValDone:
>+        get(m_dst, t0)
>+        bieq t2, EmptyValueTag, .opGetByValSlow
>+    .opGetByValNotEmpty:
>+        storei t2, TagOffset[cfr, t0, 8]
>+        storei t1, PayloadOffset[cfr, t0, 8]
>+        valueProfile(%opcodeStruct%, t5, t2, t1)
>+        dispatch()
> 
>-llintOpWithMetadata(op_get_by_val, OpGetByVal, macro (size, get, dispatch, metadata, return)
>-    metadata(t5, t2)
>-    get(m_base, t2)
>-    loadConstantOrVariablePayload(size, t2, CellTag, t0, .opGetByValSlow)
>-    move t0, t2
>-    arrayProfile(OpGetByVal::Metadata::m_arrayProfile, t2, t5, t1)
>-    get(m_property, t3)
>-    loadConstantOrVariablePayload(size, t3, Int32Tag, t1, .opGetByValSlow)
>-    loadp JSObject::m_butterfly[t0], t3
>-    andi IndexingShapeMask, t2
>-    bieq t2, Int32Shape, .opGetByValIsContiguous
>-    bineq t2, ContiguousShape, .opGetByValNotContiguous
>-
>-.opGetByValIsContiguous:
>-    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>-    loadi TagOffset[t3, t1, 8], t2
>-    loadi PayloadOffset[t3, t1, 8], t1
>-    jmp .opGetByValDone
>-
>-.opGetByValNotContiguous:
>-    bineq t2, DoubleShape, .opGetByValNotDouble
>-    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>-    loadd [t3, t1, 8], ft0
>-    bdnequn ft0, ft0, .opGetByValSlow
>-    # FIXME: This could be massively optimized.
>-    fd2ii ft0, t1, t2
>-    get(m_dst, t0)
>-    jmp .opGetByValNotEmpty
>-
>-.opGetByValNotDouble:
>-    subi ArrayStorageShape, t2
>-    bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValSlow
>-    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t3], .opGetByValSlow
>-    loadi ArrayStorage::m_vector + TagOffset[t3, t1, 8], t2
>-    loadi ArrayStorage::m_vector + PayloadOffset[t3, t1, 8], t1
>-
>-.opGetByValDone:
>-    get(m_dst, t0)
>-    bieq t2, EmptyValueTag, .opGetByValSlow
>-.opGetByValNotEmpty:
>-    storei t2, TagOffset[cfr, t0, 8]
>-    storei t1, PayloadOffset[cfr, t0, 8]
>-    valueProfile(OpGetByVal, t5, t2, t1)
>-    dispatch()
>+    .opGetByValSlow:
>+        callSlowPath(slowPathName)
>+        dispatch()
> 
>-.opGetByValSlow:
>-    callSlowPath(_llint_slow_path_get_by_val)
>-    dispatch()
>+    .osrReturnPoint:
>+        osrExitPoint(size, metadata, return)
>+    end)
>+end
> 
>-.osrReturnPoint:
>+getByValOp(get_by_val, OpGetByVal, _llint_slow_path_get_by_val, macro(size, metadata, return)
>     getterSetterOSRExitReturnPoint(op_get_by_val, size)
>     metadata(t2, t3)
>     valueProfile(OpGetByVal, t2, r1, r0)
>     return(r1, r0)
>-
> end)
> 
>+getByValOp(get_by_val_direct, OpGetByValDirect, _slow_path_get_by_val_direct, macro(a, b, c) end)
> 
> macro putByValOp(opcodeName, opcodeStruct, osrExitPoint)
>     llintOpWithMetadata(op_%opcodeName%, opcodeStruct, macro (size, get, dispatch, metadata, return)
>diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>index de00dea5c0faaf1ed0c9bc54f53eb1e41129f65e..16bcfea30f60dc5c938746ddf43ce2026af9c030 100644
>--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>@@ -1495,184 +1495,187 @@ llintOpWithMetadata(op_put_by_id, OpPutById, macro (size, get, dispatch, metadat
> 
> end)
> 
>+macro getByValOp(opcodeName, opcodeStruct, slowPathName)
>+    llintOpWithMetadata(op_%opcodeName%, %opcodeStruct%, macro (size, get, dispatch, metadata, return)
>+        macro finishGetByVal(result, scratch)
>+            get(m_dst, scratch)
>+            storeq result, [cfr, scratch, 8]
>+            valueProfile(%opcodeStruct%, t5, result)
>+            dispatch()
>+        end
> 
>-llintOpWithMetadata(op_get_by_val, OpGetByVal, macro (size, get, dispatch, metadata, return)
>-    macro finishGetByVal(result, scratch)
>-        get(m_dst, scratch)
>-        storeq result, [cfr, scratch, 8]
>-        valueProfile(OpGetByVal, t5, result)
>-        dispatch()
>-    end
>+        macro finishIntGetByVal(result, scratch)
>+            orq numberTag, result
>+            finishGetByVal(result, scratch)
>+        end
> 
>-    macro finishIntGetByVal(result, scratch)
>-        orq numberTag, result
>-        finishGetByVal(result, scratch)
>-    end
>+        macro finishDoubleGetByVal(result, scratch1, scratch2)
>+            fd2q result, scratch1
>+            subq numberTag, scratch1
>+            finishGetByVal(scratch1, scratch2)
>+        end
> 
>-    macro finishDoubleGetByVal(result, scratch1, scratch2)
>-        fd2q result, scratch1
>-        subq numberTag, scratch1
>-        finishGetByVal(scratch1, scratch2)
>-    end
>+        metadata(t5, t2)
> 
>-    metadata(t5, t2)
>+        get(m_base, t2)
>+        loadConstantOrVariableCell(size, t2, t0, .opGetByValSlow)
> 
>-    get(m_base, t2)
>-    loadConstantOrVariableCell(size, t2, t0, .opGetByValSlow)
>-
>-    move t0, t2
>-    arrayProfile(OpGetByVal::Metadata::m_arrayProfile, t2, t5, t1)
>-
>-    get(m_property, t3)
>-    loadConstantOrVariableInt32(size, t3, t1, .opGetByValSlow)
>-    sxi2q t1, t1
>-
>-    loadCagedJSValue(JSObject::m_butterfly[t0], t3, numberTag)
>-    move TagNumber, numberTag
>-
>-    andi IndexingShapeMask, t2
>-    bieq t2, Int32Shape, .opGetByValIsContiguous
>-    bineq t2, ContiguousShape, .opGetByValNotContiguous
>-
>-.opGetByValIsContiguous:
>-    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>-    get(m_dst, t0)
>-    loadq [t3, t1, 8], t2
>-    btqz t2, .opGetByValSlow
>-    jmp .opGetByValDone
>-
>-.opGetByValNotContiguous:
>-    bineq t2, DoubleShape, .opGetByValNotDouble
>-    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>-    get(m_dst, t0)
>-    loadd [t3, t1, 8], ft0
>-    bdnequn ft0, ft0, .opGetByValSlow
>-    fd2q ft0, t2
>-    subq numberTag, t2
>-    jmp .opGetByValDone
>-    
>-.opGetByValNotDouble:
>-    subi ArrayStorageShape, t2
>-    bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValNotIndexedStorage
>-    biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t3], .opGetByValSlow
>-    get(m_dst, t0)
>-    loadq ArrayStorage::m_vector[t3, t1, 8], t2
>-    btqz t2, .opGetByValSlow
>-
>-.opGetByValDone:
>-    storeq t2, [cfr, t0, 8]
>-    valueProfile(OpGetByVal, t5, t2)
>-    dispatch()
>+        move t0, t2
>+        arrayProfile(%opcodeStruct%::Metadata::m_arrayProfile, t2, t5, t1)
> 
>-.opGetByValNotIndexedStorage:
>-    # First lets check if we even have a typed array. This lets us do some boilerplate up front.
>-    loadb JSCell::m_type[t0], t2
>-    subi FirstTypedArrayType, t2
>-    biaeq t2, NumberOfTypedArrayTypesExcludingDataView, .opGetByValSlow
>-    
>-    # Sweet, now we know that we have a typed array. Do some basic things now.
>+        get(m_property, t3)
>+        loadConstantOrVariableInt32(size, t3, t1, .opGetByValSlow)
>+        sxi2q t1, t1
> 
>-    if ARM64E
>-        const length = t6
>-        const scratch = t7
>-        loadi JSArrayBufferView::m_length[t0], length
>-        biaeq t1, length, .opGetByValSlow
>-    else
>-        # length and scratch are intentionally undefined on this branch because they are not used on other platforms.
>-        biaeq t1, JSArrayBufferView::m_length[t0], .opGetByValSlow
>-    end
>+        loadCagedJSValue(JSObject::m_butterfly[t0], t3, numberTag)
>+        move TagNumber, numberTag
> 
>-    loadp JSArrayBufferView::m_vector[t0], t3
>-    cagedPrimitive(t3, length, t0, scratch)
>-
>-    # Now bisect through the various types:
>-    #    Int8ArrayType,
>-    #    Uint8ArrayType,
>-    #    Uint8ClampedArrayType,
>-    #    Int16ArrayType,
>-    #    Uint16ArrayType,
>-    #    Int32ArrayType,
>-    #    Uint32ArrayType,
>-    #    Float32ArrayType,
>-    #    Float64ArrayType,
>-
>-    bia t2, Uint16ArrayType - FirstTypedArrayType, .opGetByValAboveUint16Array
>-
>-    # We have one of Int8ArrayType .. Uint16ArrayType.
>-    bia t2, Uint8ClampedArrayType - FirstTypedArrayType, .opGetByValInt16ArrayOrUint16Array
>-
>-    # We have one of Int8ArrayType ... Uint8ClampedArrayType
>-    bia t2, Int8ArrayType - FirstTypedArrayType, .opGetByValUint8ArrayOrUint8ClampedArray
>-
>-    # We have Int8ArrayType.
>-    loadbsi [t3, t1], t0
>-    finishIntGetByVal(t0, t1)
>-
>-.opGetByValUint8ArrayOrUint8ClampedArray:
>-    bia t2, Uint8ArrayType - FirstTypedArrayType, .opGetByValUint8ClampedArray
>-
>-    # We have Uint8ArrayType.
>-    loadb [t3, t1], t0
>-    finishIntGetByVal(t0, t1)
>-
>-.opGetByValUint8ClampedArray:
>-    # We have Uint8ClampedArrayType.
>-    loadb [t3, t1], t0
>-    finishIntGetByVal(t0, t1)
>-
>-.opGetByValInt16ArrayOrUint16Array:
>-    # We have either Int16ArrayType or Uint16ClampedArrayType.
>-    bia t2, Int16ArrayType - FirstTypedArrayType, .opGetByValUint16Array
>-
>-    # We have Int16ArrayType.
>-    loadhsi [t3, t1, 2], t0
>-    finishIntGetByVal(t0, t1)
>-
>-.opGetByValUint16Array:
>-    # We have Uint16ArrayType.
>-    loadh [t3, t1, 2], t0
>-    finishIntGetByVal(t0, t1)
>-
>-.opGetByValAboveUint16Array:
>-    # We have one of Int32ArrayType .. Float64ArrayType.
>-    bia t2, Uint32ArrayType - FirstTypedArrayType, .opGetByValFloat32ArrayOrFloat64Array
>-
>-    # We have either Int32ArrayType or Uint32ArrayType
>-    bia t2, Int32ArrayType - FirstTypedArrayType, .opGetByValUint32Array
>-
>-    # We have Int32ArrayType.
>-    loadi [t3, t1, 4], t0
>-    finishIntGetByVal(t0, t1)
>-
>-.opGetByValUint32Array:
>-    # We have Uint32ArrayType.
>-    # This is the hardest part because of large unsigned values.
>-    loadi [t3, t1, 4], t0
>-    bilt t0, 0, .opGetByValSlow # This case is still awkward to implement in LLInt.
>-    finishIntGetByVal(t0, t1)
>-
>-.opGetByValFloat32ArrayOrFloat64Array:
>-    # We have one of Float32ArrayType or Float64ArrayType. Sadly, we cannot handle Float32Array
>-    # inline yet. That would require some offlineasm changes.
>-    bieq t2, Float32ArrayType - FirstTypedArrayType, .opGetByValSlow
>-
>-    # We have Float64ArrayType.
>-    loadd [t3, t1, 8], ft0
>-    bdnequn ft0, ft0, .opGetByValSlow
>-    finishDoubleGetByVal(ft0, t0, t1)
>-
>-.opGetByValSlow:
>-    callSlowPath(_llint_slow_path_get_by_val)
>-    dispatch()
>+        andi IndexingShapeMask, t2
>+        bieq t2, Int32Shape, .opGetByValIsContiguous
>+        bineq t2, ContiguousShape, .opGetByValNotContiguous
>+
>+    .opGetByValIsContiguous:
>+        biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>+        get(m_dst, t0)
>+        loadq [t3, t1, 8], t2
>+        btqz t2, .opGetByValSlow
>+        jmp .opGetByValDone
>+
>+    .opGetByValNotContiguous:
>+        bineq t2, DoubleShape, .opGetByValNotDouble
>+        biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t3], .opGetByValSlow
>+        get(m_dst, t0)
>+        loadd [t3, t1, 8], ft0
>+        bdnequn ft0, ft0, .opGetByValSlow
>+        fd2q ft0, t2
>+        subq numberTag, t2
>+        jmp .opGetByValDone
>+        
>+    .opGetByValNotDouble:
>+        subi ArrayStorageShape, t2
>+        bia t2, SlowPutArrayStorageShape - ArrayStorageShape, .opGetByValNotIndexedStorage
>+        biaeq t1, -sizeof IndexingHeader + IndexingHeader::u.lengths.vectorLength[t3], .opGetByValSlow
>+        get(m_dst, t0)
>+        loadq ArrayStorage::m_vector[t3, t1, 8], t2
>+        btqz t2, .opGetByValSlow
>+
>+    .opGetByValDone:
>+        storeq t2, [cfr, t0, 8]
>+        valueProfile(%opcodeStruct%, t5, t2)
>+        dispatch()
> 
>-.osrReturnPoint:
>-    getterSetterOSRExitReturnPoint(op_get_by_val, size)
>-    metadata(t5, t2)
>-    valueProfile(OpGetByVal, t5, r0)
>-    return(r0)
>+    .opGetByValNotIndexedStorage:
>+        # First lets check if we even have a typed array. This lets us do some boilerplate up front.
>+        loadb JSCell::m_type[t0], t2
>+        subi FirstTypedArrayType, t2
>+        biaeq t2, NumberOfTypedArrayTypesExcludingDataView, .opGetByValSlow
>+        
>+        # Sweet, now we know that we have a typed array. Do some basic things now.
> 
>-end)
>+        if ARM64E
>+            const length = t6
>+            const scratch = t7
>+            loadi JSArrayBufferView::m_length[t0], length
>+            biaeq t1, length, .opGetByValSlow
>+        else
>+            # length and scratch are intentionally undefined on this branch because they are not used on other platforms.
>+            biaeq t1, JSArrayBufferView::m_length[t0], .opGetByValSlow
>+        end
>+
>+        loadp JSArrayBufferView::m_vector[t0], t3
>+        cagedPrimitive(t3, length, t0, scratch)
>+
>+        # Now bisect through the various types:
>+        #    Int8ArrayType,
>+        #    Uint8ArrayType,
>+        #    Uint8ClampedArrayType,
>+        #    Int16ArrayType,
>+        #    Uint16ArrayType,
>+        #    Int32ArrayType,
>+        #    Uint32ArrayType,
>+        #    Float32ArrayType,
>+        #    Float64ArrayType,
>+
>+        bia t2, Uint16ArrayType - FirstTypedArrayType, .opGetByValAboveUint16Array
>+
>+        # We have one of Int8ArrayType .. Uint16ArrayType.
>+        bia t2, Uint8ClampedArrayType - FirstTypedArrayType, .opGetByValInt16ArrayOrUint16Array
>+
>+        # We have one of Int8ArrayType ... Uint8ClampedArrayType
>+        bia t2, Int8ArrayType - FirstTypedArrayType, .opGetByValUint8ArrayOrUint8ClampedArray
>+
>+        # We have Int8ArrayType.
>+        loadbsi [t3, t1], t0
>+        finishIntGetByVal(t0, t1)
>+
>+    .opGetByValUint8ArrayOrUint8ClampedArray:
>+        bia t2, Uint8ArrayType - FirstTypedArrayType, .opGetByValUint8ClampedArray
>+
>+        # We have Uint8ArrayType.
>+        loadb [t3, t1], t0
>+        finishIntGetByVal(t0, t1)
>+
>+    .opGetByValUint8ClampedArray:
>+        # We have Uint8ClampedArrayType.
>+        loadb [t3, t1], t0
>+        finishIntGetByVal(t0, t1)
>+
>+    .opGetByValInt16ArrayOrUint16Array:
>+        # We have either Int16ArrayType or Uint16ClampedArrayType.
>+        bia t2, Int16ArrayType - FirstTypedArrayType, .opGetByValUint16Array
>+
>+        # We have Int16ArrayType.
>+        loadhsi [t3, t1, 2], t0
>+        finishIntGetByVal(t0, t1)
>+
>+    .opGetByValUint16Array:
>+        # We have Uint16ArrayType.
>+        loadh [t3, t1, 2], t0
>+        finishIntGetByVal(t0, t1)
>+
>+    .opGetByValAboveUint16Array:
>+        # We have one of Int32ArrayType .. Float64ArrayType.
>+        bia t2, Uint32ArrayType - FirstTypedArrayType, .opGetByValFloat32ArrayOrFloat64Array
>+
>+        # We have either Int32ArrayType or Uint32ArrayType
>+        bia t2, Int32ArrayType - FirstTypedArrayType, .opGetByValUint32Array
>+
>+        # We have Int32ArrayType.
>+        loadi [t3, t1, 4], t0
>+        finishIntGetByVal(t0, t1)
>+
>+    .opGetByValUint32Array:
>+        # We have Uint32ArrayType.
>+        # This is the hardest part because of large unsigned values.
>+        loadi [t3, t1, 4], t0
>+        bilt t0, 0, .opGetByValSlow # This case is still awkward to implement in LLInt.
>+        finishIntGetByVal(t0, t1)
>+
>+    .opGetByValFloat32ArrayOrFloat64Array:
>+        # We have one of Float32ArrayType or Float64ArrayType. Sadly, we cannot handle Float32Array
>+        # inline yet. That would require some offlineasm changes.
>+        bieq t2, Float32ArrayType - FirstTypedArrayType, .opGetByValSlow
>+
>+        # We have Float64ArrayType.
>+        loadd [t3, t1, 8], ft0
>+        bdnequn ft0, ft0, .opGetByValSlow
>+        finishDoubleGetByVal(ft0, t0, t1)
>+
>+    .opGetByValSlow:
>+        callSlowPath(slowPathName)
>+        dispatch()
>+
>+    .osrReturnPoint:
>+        getterSetterOSRExitReturnPoint(op_%opcodeName%, size)
>+        metadata(t5, t2)
>+        valueProfile(%opcodeStruct%, t5, r0)
>+        return(r0)
>+    end)
>+end
>+
>+getByValOp(get_by_val, OpGetByVal, _llint_slow_path_get_by_val)
> 
>+getByValOp(get_by_val_direct, OpGetByValDirect, _slow_path_get_by_val_direct)
> 
> macro putByValOp(opcodeName, opcodeStruct, osrExitPoint)
>     llintOpWithMetadata(op_%opcodeName%, opcodeStruct, macro (size, get, dispatch, metadata, return)
>diff --git a/Source/JavaScriptCore/parser/ASTBuilder.h b/Source/JavaScriptCore/parser/ASTBuilder.h
>index dbd53ae76084f2da9b75e74f61f8a704c78d3960..9a796b59fb6afe35a9d52efd98cb2c659e338514 100644
>--- a/Source/JavaScriptCore/parser/ASTBuilder.h
>+++ b/Source/JavaScriptCore/parser/ASTBuilder.h
>@@ -270,12 +270,12 @@ public:
>         return node;
>     }
> 
>-    ExpressionNode* createDotAccess(const JSTokenLocation& location, ExpressionNode* base, const Identifier* property, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
>+    ExpressionNode* createDotAccess(const JSTokenLocation& location, ExpressionNode* base, const Identifier* property, DotType type, const JSTextPosition& start, const JSTextPosition& divot, const JSTextPosition& end)
>     {
>         if (base->isSuperNode())
>             usesSuperProperty();
>         
>-        DotAccessorNode* node = new (m_parserArena) DotAccessorNode(location, base, *property);
>+        DotAccessorNode* node = new (m_parserArena) DotAccessorNode(location, base, *property, type);
>         setExceptionLocation(node, start, divot, end);
>         return node;
>     }
>@@ -651,6 +651,11 @@ public:
>         return node->isAssignmentLocation();
>     }
> 
>+    bool isPrivateLocation(const Expression& node)
>+    {
>+        return node->isPrivateLocation();
>+    }
>+
>     bool isObjectLiteral(const Expression& node)
>     {
>         return node->isObjectLiteral();
>@@ -1428,15 +1433,15 @@ ExpressionNode* ASTBuilder::makeFunctionCallNode(const JSTokenLocation& location
>     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func);
>     FunctionCallDotNode* node = nullptr;
>     if (!previousBaseWasSuper && (dot->identifier() == m_vm.propertyNames->builtinNames().callPublicName() || dot->identifier() == m_vm.propertyNames->builtinNames().callPrivateName()))
>-        node = new (m_parserArena) CallFunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divotStart, divotEnd, callOrApplyChildDepth);
>+        node = new (m_parserArena) CallFunctionCallDotNode(location, dot->base(), dot->identifier(), dot->type(), args, divot, divotStart, divotEnd, callOrApplyChildDepth);
>     else if (!previousBaseWasSuper && (dot->identifier() == m_vm.propertyNames->builtinNames().applyPublicName() || dot->identifier() == m_vm.propertyNames->builtinNames().applyPrivateName())) {
>         // FIXME: This check is only needed because we haven't taught the bytecode generator to inline
>         // Reflect.apply yet. See https://bugs.webkit.org/show_bug.cgi?id=190668.
>         if (!dot->base()->isResolveNode() || static_cast<ResolveNode*>(dot->base())->identifier() != "Reflect")
>-            node = new (m_parserArena) ApplyFunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divotStart, divotEnd, callOrApplyChildDepth);
>+            node = new (m_parserArena) ApplyFunctionCallDotNode(location, dot->base(), dot->identifier(), dot->type(), args, divot, divotStart, divotEnd, callOrApplyChildDepth);
>     }
>     if (!node)
>-        node = new (m_parserArena) FunctionCallDotNode(location, dot->base(), dot->identifier(), args, divot, divotStart, divotEnd);
>+        node = new (m_parserArena) FunctionCallDotNode(location, dot->base(), dot->identifier(), dot->type(), args, divot, divotStart, divotEnd);
>     node->setSubexpressionInfo(dot->divot(), dot->divotEnd().offset);
>     return node;
> }
>@@ -1561,9 +1566,9 @@ ExpressionNode* ASTBuilder::makeAssignNode(const JSTokenLocation& location, Expr
>     ASSERT(loc->isDotAccessorNode());
>     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
>     if (op == OpEqual)
>-        return new (m_parserArena) AssignDotNode(location, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), start, end);
>+        return new (m_parserArena) AssignDotNode(location, dot->base(), dot->identifier(), dot->type(), expr, exprHasAssignments, dot->divot(), start, end);
> 
>-    ReadModifyDotNode* node = new (m_parserArena) ReadModifyDotNode(location, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, start, end);
>+    ReadModifyDotNode* node = new (m_parserArena) ReadModifyDotNode(location, dot->base(), dot->identifier(), dot->type(), op, expr, exprHasAssignments, divot, start, end);
>     node->setSubexpressionInfo(dot->divot(), dot->divotEnd().offset);
>     return node;
> }
>diff --git a/Source/JavaScriptCore/parser/Lexer.cpp b/Source/JavaScriptCore/parser/Lexer.cpp
>index c691dacfba4b27d410c817d706b52dc0c1f905ff..743764c03eafa595fec8c8164e8aead7bd90e462 100644
>--- a/Source/JavaScriptCore/parser/Lexer.cpp
>+++ b/Source/JavaScriptCore/parser/Lexer.cpp
>@@ -938,14 +938,18 @@ template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<LChar>::p
>             return keyword == RESERVED_IF_STRICT && !strictMode ? IDENT : keyword;
>         }
>     }
>-    
>-    bool isPrivateName = m_current == '@' && m_parsingBuiltinFunction;
>-    if (isPrivateName)
>+
>+    bool isPrivateName = m_current == '#';
>+    bool isPrivateIdentifier = m_current == '@' && m_parsingBuiltinFunction;
>+    if (isPrivateIdentifier)
>         shift();
>     
>     const LChar* identifierStart = currentSourcePtr();
>     unsigned identifierLineStart = currentLineStartOffset();
>-    
>+
>+    if (isPrivateName)
>+        shift();
>+
>     while (isIdentPart(m_current))
>         shift();
>     
>@@ -960,11 +964,11 @@ template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<LChar>::p
>         int identifierLength = currentSourcePtr() - identifierStart;
>         ident = makeIdentifier(identifierStart, identifierLength);
>         if (m_parsingBuiltinFunction) {
>-            if (!isSafeBuiltinIdentifier(m_vm, ident) && !isPrivateName) {
>+            if (!isSafeBuiltinIdentifier(m_vm, ident) && !isPrivateIdentifier) {
>                 m_lexErrorMessage = makeString("The use of '", ident->string(), "' is disallowed in builtin functions.");
>                 return ERRORTOK;
>             }
>-            if (isPrivateName)
>+            if (isPrivateIdentifier)
>                 ident = &m_arena->makeIdentifier(m_vm, m_vm.propertyNames->lookUpPrivateName(*ident));
>             else if (*ident == m_vm.propertyNames->undefinedKeyword)
>                 tokenData->ident = &m_vm.propertyNames->undefinedPrivateName;
>@@ -975,20 +979,21 @@ template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<LChar>::p
>     } else
>         tokenData->ident = nullptr;
> 
>-    if (UNLIKELY((remaining < maxTokenLength) && !lexerFlags.contains(LexerFlags::IgnoreReservedWords)) && !isPrivateName) {
>+    auto identType = isPrivateName ? PRIVATENAME : IDENT;
>+    if (UNLIKELY((remaining < maxTokenLength) && !lexerFlags.contains(LexerFlags::IgnoreReservedWords)) && !isPrivateIdentifier) {
>         ASSERT(shouldCreateIdentifier);
>         if (remaining < maxTokenLength) {
>             const HashTableValue* entry = JSC::mainTable.entry(*ident);
>             ASSERT((remaining < maxTokenLength) || !entry);
>             if (!entry)
>-                return IDENT;
>+                return identType;
>             JSTokenType token = static_cast<JSTokenType>(entry->lexerValue());
>-            return (token != RESERVED_IF_STRICT) || strictMode ? token : IDENT;
>+            return (token != RESERVED_IF_STRICT) || strictMode ? token : identType;
>         }
>-        return IDENT;
>+        return identType;
>     }
> 
>-    return IDENT;
>+    return identType;
> }
> 
> template <>
>@@ -1003,23 +1008,27 @@ template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<UChar>::p
>             return keyword == RESERVED_IF_STRICT && !strictMode ? IDENT : keyword;
>         }
>     }
>-    
>-    bool isPrivateName = m_current == '@' && m_parsingBuiltinFunction;
>-    if (isPrivateName)
>+
>+    bool isPrivateName = m_current == '#';
>+    bool isPrivateIdentifier = m_current == '@' && m_parsingBuiltinFunction;
>+    if (isPrivateIdentifier)
>         shift();
> 
>     const UChar* identifierStart = currentSourcePtr();
>     int identifierLineStart = currentLineStartOffset();
> 
>     UChar orAllChars = 0;
>-    
>+
>+    if (isPrivateName)
>+        shift();
>+
>     while (isIdentPart(m_current)) {
>         orAllChars |= m_current;
>         shift();
>     }
>     
>     if (UNLIKELY(m_current == '\\')) {
>-        ASSERT(!isPrivateName);
>+        ASSERT(!isPrivateIdentifier);
>         setOffsetFromSourcePtr(identifierStart, identifierLineStart);
>         return parseIdentifierSlowCase<shouldCreateIdentifier>(tokenData, lexerFlags, strictMode);
>     }
>@@ -1038,11 +1047,11 @@ template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<UChar>::p
>         else
>             ident = makeIdentifier(identifierStart, identifierLength);
>         if (m_parsingBuiltinFunction) {
>-            if (!isSafeBuiltinIdentifier(m_vm, ident) && !isPrivateName) {
>+            if (!isSafeBuiltinIdentifier(m_vm, ident) && !isPrivateIdentifier) {
>                 m_lexErrorMessage = makeString("The use of '", ident->string(), "' is disallowed in builtin functions.");
>                 return ERRORTOK;
>             }
>-            if (isPrivateName)
>+            if (isPrivateIdentifier)
>                 ident = &m_arena->makeIdentifier(m_vm, m_vm.propertyNames->lookUpPrivateName(*ident));
>             else if (*ident == m_vm.propertyNames->undefinedKeyword)
>                 tokenData->ident = &m_vm.propertyNames->undefinedPrivateName;
>@@ -1053,7 +1062,7 @@ template <bool shouldCreateIdentifier> ALWAYS_INLINE JSTokenType Lexer<UChar>::p
>     } else
>         tokenData->ident = nullptr;
>     
>-    if (UNLIKELY((remaining < maxTokenLength) && !lexerFlags.contains(LexerFlags::IgnoreReservedWords)) && !isPrivateName) {
>+    if (UNLIKELY((remaining < maxTokenLength) && !lexerFlags.contains(LexerFlags::IgnoreReservedWords)) && !isPrivateIdentifier) {
>         ASSERT(shouldCreateIdentifier);
>         if (remaining < maxTokenLength) {
>             const HashTableValue* entry = JSC::mainTable.entry(*ident);
>@@ -1073,8 +1082,13 @@ template<typename CharacterType> template<bool shouldCreateIdentifier> JSTokenTy
> {
>     tokenData->escaped = true;
>     auto identifierStart = currentSourcePtr();
>+    bool isPrivateName = *identifierStart == '#';
>+    auto identType = isPrivateName ? PRIVATENAME : IDENT;
>     bool bufferRequired = false;
> 
>+    if (isPrivateName)
>+        shift();
>+
>     while (true) {
>         if (LIKELY(isIdentPart(m_current))) {
>             shift();
>@@ -1094,7 +1108,8 @@ template<typename CharacterType> template<bool shouldCreateIdentifier> JSTokenTy
>         auto character = parseUnicodeEscape();
>         if (UNLIKELY(!character.isValid()))
>             return character.isIncomplete() ? UNTERMINATED_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK : INVALID_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK;
>-        if (UNLIKELY(m_buffer16.size() ? !isIdentPart(character.value()) : !isIdentStart(character.value())))
>+        bool isIdentifierStart = isPrivateName ? m_buffer16.size() == 1: !m_buffer16.size();
>+        if (UNLIKELY(isIdentifierStart ? !isIdentStart(character.value()) : !isIdentPart(character.value())))
>             return INVALID_IDENTIFIER_UNICODE_ESCAPE_ERRORTOK;
>         if (shouldCreateIdentifier)
>             recordUnicodeCodePoint(character.value());
>@@ -1123,13 +1138,13 @@ template<typename CharacterType> template<bool shouldCreateIdentifier> JSTokenTy
>         ASSERT(shouldCreateIdentifier);
>         const HashTableValue* entry = JSC::mainTable.entry(*ident);
>         if (!entry)
>-            return IDENT;
>+            return identType;
>         JSTokenType token = static_cast<JSTokenType>(entry->lexerValue());
>         if ((token != RESERVED_IF_STRICT) || strictMode)
>             return bufferRequired ? UNEXPECTED_ESCAPE_ERRORTOK : token;
>     }
> 
>-    return IDENT;
>+    return identType;
> }
> 
> static ALWAYS_INLINE bool characterRequiresParseStringSlowCase(LChar character)
>@@ -2407,14 +2422,21 @@ start:
>         m_hasLineTerminatorBeforeToken = true;
>         m_lineStart = m_code;
>         goto start;
>-    case CharacterHash:
>+    case CharacterHash: {
>         // Hashbang is only permitted at the start of the source text.
>-        if (peek(1) == '!' && !currentOffset()) {
>+        auto next = peek(1);
>+        if (next == '!' && !currentOffset()) {
>             shift();
>             shift();
>             goto inSingleLineComment;
>         }
>+        // Otherwise, it could be a valid PrivateName.
>+        if (Options::useClassFields() && (isIdentStart(next) || next == '\\')) {
>+            lexerFlags.remove(LexerFlags::DontBuildKeywords);
>+            goto parseIdent;
>+        }
>         goto invalidCharacter;
>+    }
>     case CharacterPrivateIdentifierStart:
>         if (m_parsingBuiltinFunction)
>             goto parseIdent;
>diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
>index 003d089f3b01f3d7f1235dad7ba2e4b310e34c92..ee3e724a8727cba45e9517d18dec87c7ed86ea58 100644
>--- a/Source/JavaScriptCore/parser/NodeConstructors.h
>+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
>@@ -327,10 +327,16 @@ namespace JSC {
>     {
>     }
> 
>-    inline DotAccessorNode::DotAccessorNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident)
>+    inline BaseDotNode::BaseDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, DotType type)
>         : ExpressionNode(location)
>         , m_base(base)
>         , m_ident(ident)
>+        , m_type(type)
>+    {
>+    }
>+
>+    inline DotAccessorNode::DotAccessorNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, DotType type)
>+        : BaseDotNode(location, base, ident, type)
>     {
>     }
>     
>@@ -418,11 +424,9 @@ namespace JSC {
>     {
>     }
> 
>-    inline FunctionCallDotNode::FunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
>-        : ExpressionNode(location)
>+    inline FunctionCallDotNode::FunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, DotType type, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
>+        : BaseDotNode(location, base, ident, type)
>         , ThrowableSubExpressionData(divot, divotStart, divotEnd)
>-        , m_base(base)
>-        , m_ident(ident)
>         , m_args(args)
>     {
>     }
>@@ -437,14 +441,14 @@ namespace JSC {
>     {
>     }
> 
>-    inline CallFunctionCallDotNode::CallFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply)
>-        : FunctionCallDotNode(location, base, ident, args, divot, divotStart, divotEnd)
>+    inline CallFunctionCallDotNode::CallFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, DotType type, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply)
>+        : FunctionCallDotNode(location, base, ident, type, args, divot, divotStart, divotEnd)
>         , m_distanceToInnermostCallOrApply(distanceToInnermostCallOrApply)
>     {
>     }
> 
>-    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply)
>-        : FunctionCallDotNode(location, base, ident, args, divot, divotStart, divotEnd)
>+    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, DotType type, ArgumentsNode* args, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply)
>+        : FunctionCallDotNode(location, base, ident, type, args, divot, divotStart, divotEnd)
>         , m_distanceToInnermostCallOrApply(distanceToInnermostCallOrApply)
>     {
>     }
>@@ -748,21 +752,17 @@ namespace JSC {
>     {
>     }
> 
>-    inline AssignDotNode::AssignDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
>-        : ExpressionNode(location)
>+    inline AssignDotNode::AssignDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, DotType type, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
>+        : BaseDotNode(location, base, ident, type)
>         , ThrowableExpressionData(divot, divotStart, divotEnd)
>-        , m_base(base)
>-        , m_ident(ident)
>         , m_right(right)
>         , m_rightHasAssignments(rightHasAssignments)
>     {
>     }
> 
>-    inline ReadModifyDotNode::ReadModifyDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
>-        : ExpressionNode(location)
>+    inline ReadModifyDotNode::ReadModifyDotNode(const JSTokenLocation& location, ExpressionNode* base, const Identifier& ident, DotType type, Operator oper, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd)
>+        : BaseDotNode(location, base, ident, type)
>         , ThrowableSubExpressionData(divot, divotStart, divotEnd)
>-        , m_base(base)
>-        , m_ident(ident)
>         , m_right(right)
>         , m_operator(oper)
>         , m_rightHasAssignments(rightHasAssignments)
>diff --git a/Source/JavaScriptCore/parser/Nodes.cpp b/Source/JavaScriptCore/parser/Nodes.cpp
>index 0b302c49355fdfb7d0240cb578c87040ffb188cf..e64b6232c15c71d8077a4344ccca5eaf0d4c093d 100644
>--- a/Source/JavaScriptCore/parser/Nodes.cpp
>+++ b/Source/JavaScriptCore/parser/Nodes.cpp
>@@ -331,7 +331,7 @@ bool PropertyListNode::hasStaticallyNamedProperty(const Identifier& propName)
> bool PropertyListNode::shouldCreateLexicalScopeForClass(PropertyListNode* list)
> {
>     while (list) {
>-        if (list->m_node->isComputedClassField())
>+        if (list->m_node->isComputedClassField() || list->m_node->isPrivate())
>             return true;
>         list = list->m_next;
>     }
>diff --git a/Source/JavaScriptCore/parser/Nodes.h b/Source/JavaScriptCore/parser/Nodes.h
>index 328f962c386d3b7c1cf2dc244a7e8f0f06bfc69c..a1a9f7e9025a2c8b47fec7741337af270d30dc04 100644
>--- a/Source/JavaScriptCore/parser/Nodes.h
>+++ b/Source/JavaScriptCore/parser/Nodes.h
>@@ -181,6 +181,7 @@ namespace JSC {
>         virtual bool isPure(BytecodeGenerator&) const { return false; }        
>         virtual bool isConstant() const { return false; }
>         virtual bool isLocation() const { return false; }
>+        virtual bool isPrivateLocation() const { return false; }
>         virtual bool isAssignmentLocation() const { return isLocation(); }
>         virtual bool isResolveNode() const { return false; }
>         virtual bool isAssignResolveNode() const { return false; }
>@@ -712,7 +713,7 @@ namespace JSC {
>     enum class ClassElementTag : uint8_t { No, Instance, Static, LastTag };
>     class PropertyNode final : public ParserArenaFreeable {
>     public:
>-        enum Type : uint8_t { Constant = 1, Getter = 2, Setter = 4, Computed = 8, Shorthand = 16, Spread = 32 };
>+        enum Type : uint8_t { Constant = 1, Getter = 2, Setter = 4, Computed = 8, Shorthand = 16, Spread = 32, Private = 64 };
>         enum PutType : uint8_t { Unknown, KnownDirect };
> 
>         PropertyNode(const Identifier&, ExpressionNode*, Type, PutType, SuperBinding, ClassElementTag);
>@@ -731,6 +732,7 @@ namespace JSC {
>         bool isClassField() const { return isClassProperty() && !needsSuperBinding(); }
>         bool isInstanceClassField() const { return isInstanceClassProperty() && !needsSuperBinding(); }
>         bool isOverriddenByDuplicate() const { return m_isOverriddenByDuplicate; }
>+        bool isPrivate() const { return m_type & Private; }
>         bool hasComputedName() const { return m_expression; }
>         bool isComputedClassField() const { return isClassField() && hasComputedName(); }
>         void setIsOverriddenByDuplicate() { m_isOverriddenByDuplicate = true; }
>@@ -741,7 +743,7 @@ namespace JSC {
>         const Identifier* m_name;
>         ExpressionNode* m_expression;
>         ExpressionNode* m_assign;
>-        unsigned m_type : 6;
>+        unsigned m_type : 7;
>         unsigned m_needsSuperBinding : 1;
>         unsigned m_putType : 1;
>         static_assert(1 << 2 > static_cast<unsigned>(ClassElementTag::LastTag), "ClassElementTag shouldn't use more than two bits");
>@@ -813,9 +815,30 @@ namespace JSC {
>         bool m_subscriptHasAssignments;
>     };
> 
>-    class DotAccessorNode final : public ExpressionNode, public ThrowableExpressionData {
>+    enum class DotType { Name, PrivateName };
>+    class BaseDotNode : public ExpressionNode {
>     public:
>-        DotAccessorNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&);
>+        BaseDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, DotType);
>+
>+        ExpressionNode* base() const { return m_base; }
>+        const Identifier& identifier() const { return m_ident; }
>+        DotType type() const { return m_type; }
>+        bool isPrivateName() const { return m_type == DotType::PrivateName; }
>+
>+        RegisterID* emitGetPropertyValue(BytecodeGenerator&, RegisterID* dst, RegisterID* base, RefPtr<RegisterID>& thisValue);
>+        RegisterID* emitGetPropertyValue(BytecodeGenerator&, RegisterID* dst, RegisterID* base);
>+        RegisterID* emitPutProperty(BytecodeGenerator&, RegisterID* base, RegisterID* value, RefPtr<RegisterID>& thisValue);
>+        RegisterID* emitPutProperty(BytecodeGenerator&, RegisterID* base, RegisterID* value);
>+
>+    protected:
>+        ExpressionNode* m_base;
>+        const Identifier& m_ident;
>+        DotType m_type;
>+    };
>+
>+    class DotAccessorNode final : public BaseDotNode, public ThrowableExpressionData {
>+    public:
>+        DotAccessorNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, DotType);
> 
>         ExpressionNode* base() const { return m_base; }
>         const Identifier& identifier() const { return m_ident; }
>@@ -824,10 +847,8 @@ namespace JSC {
>         RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>         bool isLocation() const override { return true; }
>+        bool isPrivateLocation() const override { return m_type == DotType::PrivateName; }
>         bool isDotAccessorNode() const override { return true; }
>-
>-        ExpressionNode* m_base;
>-        const Identifier& m_ident;
>     };
> 
>     class SpreadExpressionNode final : public ExpressionNode, public ThrowableExpressionData {
>@@ -940,9 +961,9 @@ namespace JSC {
>         bool m_subscriptHasAssignments;
>     };
> 
>-    class FunctionCallDotNode : public ExpressionNode, public ThrowableSubExpressionData {
>+    class FunctionCallDotNode : public BaseDotNode, public ThrowableSubExpressionData {
>     public:
>-        FunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
>+        FunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, DotType, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
> 
>     private:
>         RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -950,8 +971,6 @@ namespace JSC {
>     protected:
>         bool isFunctionCall() const override { return true; }
> 
>-        ExpressionNode* m_base;
>-        const Identifier& m_ident;
>         ArgumentsNode* m_args;
>     };
> 
>@@ -988,7 +1007,7 @@ namespace JSC {
> 
>     class CallFunctionCallDotNode final : public FunctionCallDotNode {
>     public:
>-        CallFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply);
>+        CallFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, DotType, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply);
> 
>     private:
>         RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -997,7 +1016,7 @@ namespace JSC {
>     
>     class ApplyFunctionCallDotNode final : public FunctionCallDotNode {
>     public:
>-        ApplyFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply);
>+        ApplyFunctionCallDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, DotType, ArgumentsNode*, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd, size_t distanceToInnermostCallOrApply);
> 
>     private:
>         RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
>@@ -1432,28 +1451,24 @@ namespace JSC {
>         bool m_rightHasAssignments : 1;
>     };
> 
>-    class AssignDotNode final : public ExpressionNode, public ThrowableExpressionData {
>+    class AssignDotNode final : public BaseDotNode, public ThrowableExpressionData {
>     public:
>-        AssignDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
>+        AssignDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, DotType, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
> 
>     private:
>         RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>-        ExpressionNode* m_base;
>-        const Identifier& m_ident;
>         ExpressionNode* m_right;
>         bool m_rightHasAssignments;
>     };
> 
>-    class ReadModifyDotNode final : public ExpressionNode, public ThrowableSubExpressionData {
>+    class ReadModifyDotNode final : public BaseDotNode, public ThrowableSubExpressionData {
>     public:
>-        ReadModifyDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, Operator, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
>+        ReadModifyDotNode(const JSTokenLocation&, ExpressionNode* base, const Identifier&, DotType, Operator, ExpressionNode* right, bool rightHasAssignments, const JSTextPosition& divot, const JSTextPosition& divotStart, const JSTextPosition& divotEnd);
> 
>     private:
>         RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) override;
> 
>-        ExpressionNode* m_base;
>-        const Identifier& m_ident;
>         ExpressionNode* m_right;
>         unsigned m_operator : 31;
>         bool m_rightHasAssignments : 1;
>@@ -2232,7 +2247,7 @@ namespace JSC {
> 
>     class DefineFieldNode final : public StatementNode {
>     public:
>-        enum class Type { Name, ComputedName };
>+        enum class Type { Name, PrivateName, ComputedName };
>         DefineFieldNode(const JSTokenLocation&, const Identifier*, ExpressionNode*, Type);
> 
>     private:
>diff --git a/Source/JavaScriptCore/parser/Parser.cpp b/Source/JavaScriptCore/parser/Parser.cpp
>index bb82974de7f9a58e44f0b63376ac69b94f0b6572..2a241eb54f30728a2e13e7e6b17ef6e9512e316f 100644
>--- a/Source/JavaScriptCore/parser/Parser.cpp
>+++ b/Source/JavaScriptCore/parser/Parser.cpp
>@@ -837,6 +837,8 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseVariableDecl
>         TreeExpression node = 0;
>         declarations++;
>         bool hasInitializer = false;
>+
>+        failIfTrue(match(PRIVATENAME), "Cannot use a private name to declare a variable");
>         if (matchSpecIdentifier()) {
>             failIfTrue(match(LET) && (declarationType == DeclarationType::LetDeclaration || declarationType == DeclarationType::ConstDeclaration), 
>                 "Cannot use 'let' as an identifier name for a LexicalDeclaration");
>@@ -1292,6 +1294,8 @@ template <class TreeBuilder> TreeDestructuringPattern Parser<LexerType>::parseDe
>             if (kind == DestructuringKind::DestructureToExpressions)
>                 return 0;
>             semanticFailureDueToKeyword(destructuringKindToVariableKindName(kind));
>+            if (kind != DestructuringKind::DestructureToParameters)
>+                failIfTrue(match(PRIVATENAME), "Cannot use a private name as a ", destructuringKindToVariableKindName(kind));
>             failWithMessage("Expected a parameter pattern or a ')' in parameter list");
>         }
>         failIfTrue(match(LET) && (kind == DestructuringKind::DestructureToLet || kind == DestructuringKind::DestructureToConst), "Cannot use 'let' as an identifier name for a LexicalDeclaration");
>@@ -2947,6 +2951,19 @@ parseMethod:
>             failIfFalse(computedPropertyName, "Cannot parse computed property name");
>             handleProductionOrFail(CLOSEBRACKET, "]", "end", "computed property name");
>             break;
>+        case PRIVATENAME: {
>+            ASSERT(Options::useClassFields());
>+            JSToken token = m_token;
>+            ident = m_token.m_data.ident;
>+            failIfTrue(tag == ClassElementTag::Static, "Static class element cannot be private");
>+            failIfTrue(isGetter || isSetter, "Cannot parse class method with private name");
>+            ASSERT(ident);
>+            next();
>+            failIfTrue(matchAndUpdate(OPENPAREN, token), "Cannot parse class method with private name");
>+            semanticFailIfTrue(classScope->declarePrivateName(*ident) & DeclarationResult::InvalidDuplicateDeclaration, "Cannot declare private field twice");
>+            type = static_cast<PropertyNode::Type>(type | PropertyNode::Private);
>+            break;
>+        }
>         default:
>             if (m_token.m_type & KeywordTokenFlag)
>                 goto namedKeyword;
>@@ -2963,6 +2980,7 @@ parseMethod:
>         } else if (Options::useClassFields() && !match(OPENPAREN) && tag == ClassElementTag::Instance && parseMode == SourceParseMode::MethodMode && !isGetter && !isSetter) {
>             if (ident) {
>                 semanticFailIfTrue(*ident == propertyNames.constructor, "Cannot declare class field named 'constructor'");
>+                semanticFailIfTrue(*ident == propertyNames.constructorPrivateField, "Cannot declare private class field named '#constructor'");
>             }
> 
>             if (computedPropertyName) {
>@@ -3027,6 +3045,10 @@ parseMethod:
>     info.endOffset = tokenLocation().endOffset - 1;
>     consumeOrFail(CLOSEBRACE, "Expected a closing '}' after a class body");
> 
>+    if (Options::useClassFields()) {
>+        // Fail if there are no parent private name scopes and any used-but-undeclared private names.
>+        semanticFailIfFalse(copyPrivateNameUsesToOuterScope(), "Cannot reference undeclared private names");
>+    }
>     auto classExpression = context.createClassExpr(location, info, classScope->finalizeLexicalEnvironment(), constructor, parentClass, classElements);
>     popScope(classScope, TreeBuilder::NeedsFreeVariableInfo);
>     return classExpression;
>@@ -3050,6 +3072,9 @@ template <class TreeBuilder> TreeSourceElements Parser<LexerType>::parseInstance
>         TreeExpression computedPropertyName = 0;
>         DefineFieldNode::Type type = DefineFieldNode::Type::Name;
>         switch (m_token.m_type) {
>+        case PRIVATENAME:
>+            type = DefineFieldNode::Type::PrivateName;
>+            FALLTHROUGH;
>         case STRING:
>         case IDENT:
>         namedKeyword:
>@@ -3084,6 +3109,9 @@ template <class TreeBuilder> TreeSourceElements Parser<LexerType>::parseInstance
>         if (consume(EQUAL))
>             initializer = parseAssignmentExpression(context);
> 
>+        if (type == DefineFieldNode::Type::PrivateName)
>+            currentScope()->useVariable(ident, false);
>+
>         TreeStatement defineField = context.createDefineField(fieldLocation, ident, initializer, type);
>         context.appendStatement(sourceElements, defineField);
>     }
>@@ -4761,6 +4789,22 @@ static inline void recordCallOrApplyDepth(ParserType*, VM&, Optional<typename Pa
> {
> }
> 
>+template <typename LexerType>
>+bool Parser<LexerType>::addPrivateNameUsedIfNeeded(const Identifier* ident)
>+{
>+    if (m_lexer->isReparsingFunction())
>+        return true;
>+
>+    bool found = false;
>+    ScopeRef current = currentPrivateNameScope(&found);
>+    if (!found)
>+        return false;
>+    if (!current->hasPrivateName(*ident))
>+        current->usePrivateName(*ident);
>+
>+    return true;
>+}
>+
> template <typename LexerType>
> template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpression(TreeBuilder& context)
> {
>@@ -4876,6 +4920,8 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
> 
>             SavePoint savePoint = createSavePoint();
>             next();
>+            if (Options::useClassFields())
>+                semanticFailIfTrue(match(PRIVATENAME), "Cannot access private identifiers in an optional chain");
>             if (match(OPENBRACKET) || match(OPENPAREN) || match(BACKQUOTE))
>                 type = m_token.m_type;
>             else {
>@@ -4963,8 +5009,21 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseMemberExpres
>                 m_parserState.nonTrivialExpressionCount++;
>                 JSTextPosition expressionEnd = lastTokenEndPosition();
>                 nextExpectIdentifier(TreeBuilder::DontBuildKeywords | LexerFlags::IgnoreReservedWords);
>+                const Identifier* ident = m_token.m_data.ident;
>+                auto type = DotType::Name;
>+                if (Options::useClassFields() && match(PRIVATENAME)) {
>+                    ASSERT(ident);
>+                    failIfTrue(baseIsSuper, "Cannot access private names from super");
>+                    if (UNLIKELY(currentScope()->evalContextType() == EvalContextType::InstanceFieldEvalContext))
>+                        semanticFailIfFalse(currentScope()->hasPrivateName(*ident), "Cannot reference undeclared private field '", ident->impl(), "'");
>+                    semanticFailIfFalse(addPrivateNameUsedIfNeeded(ident), "Cannot reference private names outside of class");
>+                    m_parserState.lastPrivateName = ident;
>+                    currentScope()->useVariable(ident, false);
>+                    type = DotType::PrivateName;
>+                    m_token.m_type = IDENT;
>+                }
>                 matchOrFail(IDENT, "Expected a property name after ", optionalChainBase ? "'?.'" : "'.'");
>-                base = context.createDotAccess(startLocation, base, m_token.m_data.ident, expressionStart, expressionEnd, tokenEndPosition());
>+                base = context.createDotAccess(startLocation, base, ident, type, expressionStart, expressionEnd, tokenEndPosition());
>                 if (UNLIKELY(baseIsSuper && currentScope()->isArrowFunction()))
>                     currentFunctionScope()->setInnerArrowFunctionUsesSuperProperty();
>                 next();
>@@ -5157,6 +5216,7 @@ template <class TreeBuilder> TreeExpression Parser<LexerType>::parseUnaryExpress
>             break;
>         case DELETETOKEN:
>             failIfTrueIfStrict(context.isResolve(expr), "Cannot delete unqualified property '", m_parserState.lastIdentifier->impl(), "' in strict mode");
>+            semanticFailIfTrue(context.isPrivateLocation(expr), "Cannot delete private field ", m_parserState.lastPrivateName->impl());
>             expr = context.makeDeleteNode(location, expr, context.unaryTokenStackLastStart(tokenStackDepth), end, end);
>             break;
>         default:
>@@ -5228,7 +5288,11 @@ template <typename LexerType> void Parser<LexerType>::printUnexpectedTokenText(W
>     case INVALID_PRIVATE_NAME_ERRORTOK:
>         out.print("Invalid private name '", getToken(), "'");
>         return;
>-            
>+
>+    case PRIVATENAME:
>+        out.print("Unexpected private name ", getToken());
>+        return;
>+
>     case AWAIT:
>     case IDENT:
>         out.print("Unexpected identifier '", getToken(), "'");
>diff --git a/Source/JavaScriptCore/parser/Parser.h b/Source/JavaScriptCore/parser/Parser.h
>index 437dce613e8a6d8e8ebf42de18e43f95b8493c39..a1a414d3ede7df34460e5ccf067ed29d2774c19f 100644
>--- a/Source/JavaScriptCore/parser/Parser.h
>+++ b/Source/JavaScriptCore/parser/Parser.h
>@@ -181,6 +181,7 @@ public:
>         , m_hasArguments(false)
>         , m_isEvalContext(false)
>         , m_hasNonSimpleParameterList(false)
>+        , m_isPrivateNameScope(false)
>         , m_isClassScope(false)
>         , m_evalContextType(EvalContextType::None)
>         , m_constructorKind(static_cast<unsigned>(ConstructorKind::None))
>@@ -289,6 +290,7 @@ public:
>     bool isGeneratorBoundary() const { return m_isGeneratorBoundary; }
>     bool isAsyncFunction() const { return m_isAsyncFunction; }
>     bool isAsyncFunctionBoundary() const { return m_isAsyncFunctionBoundary; }
>+    bool isPrivateNameScope() const { return m_isPrivateNameScope; }
>     bool isClassScope() const { return m_isClassScope; }
> 
>     bool hasArguments() const { return m_hasArguments; }
>@@ -305,8 +307,14 @@ public:
>         m_allowsLexicalDeclarations = true;
>     }
> 
>+    void setIsPrivateNameScope()
>+    {
>+        m_isPrivateNameScope = true;
>+    }
>+
>     void setIsClassScope()
>     {
>+        setIsPrivateNameScope();
>         m_isClassScope = true;
>     }
> 
>@@ -471,7 +479,44 @@ public:
>     {
>         return m_lexicalVariables.contains(ident.get());
>     }
>-    
>+
>+    bool hasPrivateName(const Identifier& ident)
>+    {
>+        return m_lexicalVariables.hasPrivateName(ident);
>+    }
>+
>+    void copyPrivateNameUses(Scope& other)
>+    {
>+        m_lexicalVariables.copyPrivateNameUses(other.m_lexicalVariables);
>+    }
>+
>+    bool hasUsedButUndeclaredPrivateNames() const
>+    {
>+        if (m_lexicalVariables.privateNamesSize() > 0) {
>+            for (auto entry : m_lexicalVariables.privateNames()) {
>+                if (entry.value.isUsed() && !entry.value.isDeclared())
>+                    return true;
>+            }
>+        }
>+        return false;
>+    }
>+
>+    void usePrivateName(const Identifier& ident)
>+    {
>+        ASSERT(m_allowsLexicalDeclarations);
>+        m_lexicalVariables.usePrivateName(ident);
>+    }
>+
>+    DeclarationResultMask declarePrivateName(const Identifier& ident)
>+    {
>+        ASSERT(m_allowsLexicalDeclarations);
>+        DeclarationResultMask result = DeclarationResult::Valid;
>+        auto addResult = m_lexicalVariables.declarePrivateName(ident);
>+        if (!addResult.isNewEntry)
>+            result |= DeclarationResult::InvalidDuplicateDeclaration;
>+        return result;
>+    }
>+
>     ALWAYS_INLINE bool hasDeclaredParameter(const Identifier& ident)
>     {
>         return hasDeclaredParameter(ident.impl());
>@@ -834,6 +879,7 @@ private:
>     bool m_hasArguments;
>     bool m_isEvalContext;
>     bool m_hasNonSimpleParameterList;
>+    bool m_isPrivateNameScope;
>     bool m_isClassScope;
>     EvalContextType m_evalContextType;
>     unsigned m_constructorKind;
>@@ -905,7 +951,7 @@ public:
>     ~Parser();
> 
>     template <class ParsedNode>
>-    std::unique_ptr<ParsedNode> parse(ParserError&, const Identifier&, SourceParseMode, ParsingContext, Optional<int> functionConstructorParametersEndPosition = WTF::nullopt, const Vector<JSTextPosition>& = Vector<JSTextPosition>());
>+    std::unique_ptr<ParsedNode> parse(ParserError&, const Identifier&, SourceParseMode, ParsingContext, Optional<int> functionConstructorParametersEndPosition = WTF::nullopt, const VariableEnvironment* = nullptr, const Vector<JSTextPosition>& = Vector<JSTextPosition>());
> 
>     JSTextPosition positionBeforeLastNewline() const { return m_lexer->positionBeforeLastNewline(); }
>     JSTokenLocation locationBeforeLastToken() const { return m_lexer->lastTokenLocation(); }
>@@ -1178,6 +1224,33 @@ private:
>         return ScopeRef(&m_scopeStack, i);
>     }
> 
>+    ScopeRef currentPrivateNameScope(bool *found = 0)
>+    {
>+        unsigned i = m_scopeStack.size() - 1;
>+        ASSERT(i < m_scopeStack.size());
>+        while (i && !m_scopeStack[i].isPrivateNameScope())
>+            i--;
>+        if (found)
>+            *found = m_scopeStack[i].isPrivateNameScope();
>+        return ScopeRef(&m_scopeStack, i);
>+    }
>+
>+    bool copyPrivateNameUsesToOuterScope()
>+    {
>+        ScopeRef current = currentPrivateNameScope();
>+        unsigned i = current.index() - 1;
>+        while (i && !m_scopeStack[i].isPrivateNameScope()) {
>+            i--;
>+            ASSERT(i < m_scopeStack.size());
>+        }
>+
>+        if (!i)
>+            return !current->hasUsedButUndeclaredPrivateNames();
>+
>+        current->copyPrivateNameUses(m_scopeStack[i]);
>+        return true;
>+    }
>+
>     ScopeRef closestParentOrdinaryFunctionNonLexicalScope()
>     {
>         unsigned i = m_scopeStack.size() - 1;
>@@ -1444,6 +1517,16 @@ private:
>     {
>         return m_token.m_type == expected;
>     }
>+
>+    ALWAYS_INLINE bool matchAndUpdate(JSTokenType expected, const JSToken& token)
>+    {
>+        if (match(expected)) {
>+            m_token = token;
>+            return true;
>+        }
>+
>+        return false;
>+    }
>     
>     ALWAYS_INLINE bool matchContextualKeyword(const Identifier& identifier)
>     {
>@@ -1694,6 +1777,8 @@ private:
> 
>     template <class TreeBuilder> ALWAYS_INLINE bool isSimpleAssignmentTarget(TreeBuilder&, TreeExpression);
> 
>+    ALWAYS_INLINE bool addPrivateNameUsedIfNeeded(const Identifier*);
>+
>     ALWAYS_INLINE int isBinaryOperator(JSTokenType);
>     bool allowAutomaticSemicolon();
>     
>@@ -1787,6 +1872,7 @@ private:
>         FunctionParsePhase functionParsePhase { FunctionParsePhase::Body };
>         const Identifier* lastIdentifier { nullptr };
>         const Identifier* lastFunctionName { nullptr };
>+        const Identifier* lastPrivateName { nullptr };
>         bool allowAwait { true };
>         bool isParsingClassFieldInitializer { false };
>     };
>@@ -1929,7 +2015,7 @@ private:
> 
> template <typename LexerType>
> template <class ParsedNode>
>-std::unique_ptr<ParsedNode> Parser<LexerType>::parse(ParserError& error, const Identifier& calleeName, SourceParseMode parseMode, ParsingContext parsingContext, Optional<int> functionConstructorParametersEndPosition, const Vector<JSTextPosition>& instanceFieldLocations)
>+std::unique_ptr<ParsedNode> Parser<LexerType>::parse(ParserError& error, const Identifier& calleeName, SourceParseMode parseMode, ParsingContext parsingContext, Optional<int> functionConstructorParametersEndPosition, const VariableEnvironment* variablesUnderTDZ, const Vector<JSTextPosition>& instanceFieldLocations)
> {
>     int errLine;
>     String errMsg;
>@@ -1946,6 +2032,13 @@ std::unique_ptr<ParsedNode> Parser<LexerType>::parse(ParserError& error, const I
>     ASSERT(m_source->startColumn() > OrdinalNumber::beforeFirst());
>     unsigned startColumn = m_source->startColumn().zeroBasedInt();
> 
>+    if (isEvalNode<ParsedNode>() && variablesUnderTDZ) {
>+        if (variablesUnderTDZ->privateNamesSize()) {
>+            currentScope()->setIsPrivateNameScope();
>+            variablesUnderTDZ->copyPrivateNames(currentScope()->lexicalVariables());
>+        }
>+    }
>+
>     String parseError = parseInner(calleeName, parseMode, parsingContext, functionConstructorParametersEndPosition, instanceFieldLocations);
> 
>     int lineNumber = m_lexer->lineNumber();
>@@ -2031,6 +2124,7 @@ std::unique_ptr<ParsedNode> parse(
>     DerivedContextType derivedContextType = DerivedContextType::None,
>     EvalContextType evalContextType = EvalContextType::None,
>     DebuggerParseData* debuggerParseData = nullptr,
>+    const VariableEnvironment* variablesUnderTDZ = nullptr,
>     const Vector<JSTextPosition>& instanceFieldLocations = Vector<JSTextPosition>())
> {
>     ASSERT(!source.provider()->source().isNull());
>@@ -2042,7 +2136,7 @@ std::unique_ptr<ParsedNode> parse(
>     std::unique_ptr<ParsedNode> result;
>     if (source.provider()->source().is8Bit()) {
>         Parser<Lexer<LChar>> parser(vm, source, builtinMode, strictMode, scriptMode, parseMode, superBinding, defaultConstructorKindForTopLevelFunction, derivedContextType, isEvalNode<ParsedNode>(), evalContextType, debuggerParseData);
>-        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, instanceFieldLocations);
>+        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, variablesUnderTDZ, instanceFieldLocations);
>         if (positionBeforeLastNewline)
>             *positionBeforeLastNewline = parser.positionBeforeLastNewline();
>         if (builtinMode == JSParserBuiltinMode::Builtin) {
>@@ -2055,7 +2149,7 @@ std::unique_ptr<ParsedNode> parse(
>     } else {
>         ASSERT_WITH_MESSAGE(defaultConstructorKindForTopLevelFunction == ConstructorKind::None, "BuiltinExecutables's special constructors should always use a 8-bit string");
>         Parser<Lexer<UChar>> parser(vm, source, builtinMode, strictMode, scriptMode, parseMode, superBinding, defaultConstructorKindForTopLevelFunction, derivedContextType, isEvalNode<ParsedNode>(), evalContextType, debuggerParseData);
>-        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, instanceFieldLocations);
>+        result = parser.parse<ParsedNode>(error, name, parseMode, isEvalNode<ParsedNode>() ? ParsingContext::Eval : ParsingContext::Program, WTF::nullopt, variablesUnderTDZ, instanceFieldLocations);
>         if (positionBeforeLastNewline)
>             *positionBeforeLastNewline = parser.positionBeforeLastNewline();
>     }
>diff --git a/Source/JavaScriptCore/parser/ParserTokens.h b/Source/JavaScriptCore/parser/ParserTokens.h
>index 30d2e2dea4c116f772330ed948db90db7b14a53b..6be30c13791670164ca3774c158baf78cd8632ed 100644
>--- a/Source/JavaScriptCore/parser/ParserTokens.h
>+++ b/Source/JavaScriptCore/parser/ParserTokens.h
>@@ -114,6 +114,7 @@ enum JSTokenType {
>     DOUBLE,
>     BIGINT,
>     IDENT,
>+    PRIVATENAME,
>     STRING,
>     TEMPLATE,
>     REGEXP,
>diff --git a/Source/JavaScriptCore/parser/SyntaxChecker.h b/Source/JavaScriptCore/parser/SyntaxChecker.h
>index 656781c74711fef63a8c6adc67bc9526e048732b..f859f683107fc3813d63ad3e8a678d440bc8e9ce 100644
>--- a/Source/JavaScriptCore/parser/SyntaxChecker.h
>+++ b/Source/JavaScriptCore/parser/SyntaxChecker.h
>@@ -73,7 +73,7 @@ public:
>         ResolveEvalExpr, ResolveExpr, IntegerExpr, DoubleExpr, StringExpr, BigIntExpr,
>         ThisExpr, NullExpr, BoolExpr, RegExpExpr, ObjectLiteralExpr,
>         FunctionExpr, ClassExpr, SuperExpr, ImportExpr, BracketExpr, DotExpr, CallExpr,
>-        NewExpr, PreExpr, PostExpr, UnaryExpr, BinaryExpr, OptionalChain,
>+        NewExpr, PreExpr, PostExpr, UnaryExpr, BinaryExpr, OptionalChain, PrivateDotExpr,
>         ConditionalExpr, AssignmentExpr, TypeofExpr,
>         DeleteExpr, ArrayLiteralExpr, BindingDestructuring, RestParameter,
>         ArrayDestructuring, ObjectDestructuring, SourceElementsResult,
>@@ -180,7 +180,7 @@ public:
>     ExpressionType createBoolean(const JSTokenLocation&, bool) { return BoolExpr; }
>     ExpressionType createNull(const JSTokenLocation&) { return NullExpr; }
>     ExpressionType createBracketAccess(const JSTokenLocation&, ExpressionType, ExpressionType, bool, int, int, int) { return BracketExpr; }
>-    ExpressionType createDotAccess(const JSTokenLocation&, ExpressionType, const Identifier*, int, int, int) { return DotExpr; }
>+    ExpressionType createDotAccess(const JSTokenLocation&, ExpressionType, const Identifier*, DotType type, int, int, int) { return type == DotType::PrivateName ? PrivateDotExpr : DotExpr; }
>     ExpressionType createRegExp(const JSTokenLocation&, const Identifier& pattern, const Identifier& flags, int) { return Yarr::hasError(Yarr::checkSyntax(pattern.string(), flags.string())) ? 0 : RegExpExpr; }
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int, int, int) { return NewExpr; }
>     ExpressionType createNewExpr(const JSTokenLocation&, ExpressionType, int, int) { return NewExpr; }
>@@ -401,7 +401,12 @@ public:
> 
>     bool isLocation(ExpressionType type)
>     {
>-        return type == ResolveExpr || type == DotExpr || type == BracketExpr;
>+        return type == ResolveExpr || type == DotExpr || type == PrivateDotExpr || type == BracketExpr;
>+    }
>+
>+    bool isPrivateLocation(ExpressionType type)
>+    {
>+        return type == PrivateDotExpr;
>     }
> 
>     bool isAssignmentLocation(ExpressionType type)
>diff --git a/Source/JavaScriptCore/parser/VariableEnvironment.cpp b/Source/JavaScriptCore/parser/VariableEnvironment.cpp
>index 8e69151c7b6cb3111b0fe77ce8973074062f5f5a..1f57088a34c663ca702f77d47740696e267688ef 100644
>--- a/Source/JavaScriptCore/parser/VariableEnvironment.cpp
>+++ b/Source/JavaScriptCore/parser/VariableEnvironment.cpp
>@@ -29,6 +29,16 @@
> 
> namespace JSC {
> 
>+VariableEnvironment& VariableEnvironment::operator=(const VariableEnvironment& other)
>+{
>+    m_map = other.m_map;
>+    m_isEverythingCaptured = other.m_isEverythingCaptured;
>+    m_rareData.reset();
>+    if (other.m_rareData)
>+        m_rareData = WTF::makeUnique<VariableEnvironment::RareData>(*other.m_rareData);
>+    return *this;
>+}
>+
> void VariableEnvironment::markVariableAsCapturedIfDefined(const RefPtr<UniquedStringImpl>& identifier)
> {
>     auto findResult = m_map.find(identifier);
>@@ -80,6 +90,7 @@ void VariableEnvironment::swap(VariableEnvironment& other)
> {
>     m_map.swap(other.m_map);
>     m_isEverythingCaptured = other.m_isEverythingCaptured;
>+    m_rareData.swap(other.m_rareData);
> }
> 
> void VariableEnvironment::markVariableAsImported(const RefPtr<UniquedStringImpl>& identifier)
>@@ -100,7 +111,7 @@ CompactVariableEnvironment::CompactVariableEnvironment(const VariableEnvironment
>     : m_isEverythingCaptured(env.isEverythingCaptured())
> {
>     Vector<std::pair<UniquedStringImpl*, VariableEnvironmentEntry>, 32> sortedEntries;
>-    sortedEntries.reserveInitialCapacity(env.size());
>+    sortedEntries.reserveInitialCapacity(env.mapSize());
>     for (auto& pair : env)
>         sortedEntries.append({ pair.key.get(), pair.value });
> 
>diff --git a/Source/JavaScriptCore/parser/VariableEnvironment.h b/Source/JavaScriptCore/parser/VariableEnvironment.h
>index 7adc7e13879004d4d7c9330cfe5c7a7ae9bda3bb..7c6d5b18381daa3a9107e3b460c3e8d5b27d7e11 100644
>--- a/Source/JavaScriptCore/parser/VariableEnvironment.h
>+++ b/Source/JavaScriptCore/parser/VariableEnvironment.h
>@@ -27,6 +27,8 @@
> 
> #include "Identifier.h"
> #include <wtf/HashMap.h>
>+#include <wtf/HashSet.h>
>+#include <wtf/IteratorRange.h>
> 
> namespace JSC {
> 
>@@ -42,6 +44,7 @@ public:
>     ALWAYS_INLINE bool isFunction() const { return m_bits & IsFunction; }
>     ALWAYS_INLINE bool isParameter() const { return m_bits & IsParameter; }
>     ALWAYS_INLINE bool isSloppyModeHoistingCandidate() const { return m_bits & IsSloppyModeHoistingCandidate; }
>+    ALWAYS_INLINE bool isPrivateName() const { return m_bits & IsPrivateName; }
> 
>     ALWAYS_INLINE void setIsCaptured() { m_bits |= IsCaptured; }
>     ALWAYS_INLINE void setIsConst() { m_bits |= IsConst; }
>@@ -53,6 +56,7 @@ public:
>     ALWAYS_INLINE void setIsFunction() { m_bits |= IsFunction; }
>     ALWAYS_INLINE void setIsParameter() { m_bits |= IsParameter; }
>     ALWAYS_INLINE void setIsSloppyModeHoistingCandidate() { m_bits |= IsSloppyModeHoistingCandidate; }
>+    ALWAYS_INLINE void setIsPrivateName() { m_bits |= IsPrivateName; }
> 
>     ALWAYS_INLINE void clearIsVar() { m_bits &= ~IsVar; }
> 
>@@ -74,7 +78,8 @@ private:
>         IsImportedNamespace = 1 << 6,
>         IsFunction = 1 << 7,
>         IsParameter = 1 << 8,
>-        IsSloppyModeHoistingCandidate = 1 << 9
>+        IsSloppyModeHoistingCandidate = 1 << 9,
>+        IsPrivateName = 1 << 10,
>     };
>     uint16_t m_bits { 0 };
> };
>@@ -83,15 +88,55 @@ struct VariableEnvironmentEntryHashTraits : HashTraits<VariableEnvironmentEntry>
>     static constexpr bool needsDestruction = false;
> };
> 
>+struct PrivateNameEntry {
>+public:
>+    PrivateNameEntry(uint16_t traits = 0) { m_bits = traits; }
>+
>+    ALWAYS_INLINE bool isUsed() const { return m_bits & IsUsed; }
>+    ALWAYS_INLINE bool isDeclared() const { return m_bits & IsDeclared; }
>+
>+    ALWAYS_INLINE void setIsUsed() { m_bits |= IsUsed; }
>+    ALWAYS_INLINE void setIsDeclared() { m_bits |= IsDeclared; }
>+
>+    uint16_t bits() const { return m_bits; }
>+
>+    bool operator==(const PrivateNameEntry& other) const
>+    {
>+        return m_bits == other.m_bits;
>+    }
>+
>+    enum Traits : uint16_t {
>+        IsUsed = 1 << 0,
>+        IsDeclared = 1 << 1,
>+    };
>+
>+private:
>+    uint16_t m_bits { 0 };
>+};
>+
>+struct PrivateNameEntryHashTraits : HashTraits<PrivateNameEntry> {
>+    static const bool needsDestruction = false;
>+};
>+
> class VariableEnvironment {
> private:
>     typedef HashMap<RefPtr<UniquedStringImpl>, VariableEnvironmentEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> Map;
>+    typedef HashMap<RefPtr<UniquedStringImpl>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> PrivateNames;
> public:
>-    VariableEnvironment() = default;
>-    VariableEnvironment(VariableEnvironment&& other) = default;
>-    VariableEnvironment(const VariableEnvironment&) = default;
>-    VariableEnvironment& operator=(const VariableEnvironment&) = default;
>-    VariableEnvironment& operator=(VariableEnvironment&&) = default;
>+    VariableEnvironment() { }
>+    VariableEnvironment(VariableEnvironment&& other)
>+        : m_map(WTFMove(other.m_map))
>+        , m_isEverythingCaptured(other.m_isEverythingCaptured)
>+        , m_rareData(WTFMove(other.m_rareData))
>+    {
>+    }
>+    VariableEnvironment(const VariableEnvironment& other)
>+        : m_map(other.m_map)
>+        , m_isEverythingCaptured(other.m_isEverythingCaptured)
>+        , m_rareData(other.m_rareData ? WTF::makeUnique<VariableEnvironment::RareData>(*other.m_rareData) : nullptr)
>+    {
>+    }
>+    VariableEnvironment& operator=(const VariableEnvironment& other);
> 
>     ALWAYS_INLINE Map::iterator begin() { return m_map.begin(); }
>     ALWAYS_INLINE Map::iterator end() { return m_map.end(); }
>@@ -99,7 +144,8 @@ public:
>     ALWAYS_INLINE Map::const_iterator end() const { return m_map.end(); }
>     ALWAYS_INLINE Map::AddResult add(const RefPtr<UniquedStringImpl>& identifier) { return m_map.add(identifier, VariableEnvironmentEntry()); }
>     ALWAYS_INLINE Map::AddResult add(const Identifier& identifier) { return add(identifier.impl()); }
>-    ALWAYS_INLINE unsigned size() const { return m_map.size(); }
>+    ALWAYS_INLINE unsigned size() const { return m_map.size() + privateNamesSize(); }
>+    ALWAYS_INLINE unsigned mapSize() const { return m_map.size(); }
>     ALWAYS_INLINE bool contains(const RefPtr<UniquedStringImpl>& identifier) const { return m_map.contains(identifier); }
>     ALWAYS_INLINE bool remove(const RefPtr<UniquedStringImpl>& identifier) { return m_map.remove(identifier); }
>     ALWAYS_INLINE Map::iterator find(const RefPtr<UniquedStringImpl>& identifier) { return m_map.find(identifier); }
>@@ -116,11 +162,106 @@ public:
>     bool isEverythingCaptured() const { return m_isEverythingCaptured; }
>     bool isEmpty() const { return !m_map.size(); }
> 
>+    typedef WTF::IteratorRange<PrivateNames::iterator> PrivateNamesRange;
>+
>+    ALWAYS_INLINE Map::AddResult declarePrivateName(const Identifier& identifier) { return declarePrivateName(identifier.impl()); }
>+    ALWAYS_INLINE void usePrivateName(const Identifier& identifier) { usePrivateName(identifier.impl()); }
>+
>+    Map::AddResult declarePrivateName(const RefPtr<UniquedStringImpl>& identifier)
>+    {
>+        auto& meta = getOrAddPrivateName(identifier.get());
>+        meta.setIsDeclared();
>+        auto entry = VariableEnvironmentEntry();
>+        entry.setIsPrivateName();
>+        entry.setIsConst();
>+        entry.setIsCaptured();
>+        return m_map.add(identifier, entry);
>+    }
>+    void usePrivateName(const RefPtr<UniquedStringImpl>& identifier)
>+    {
>+        auto& meta = getOrAddPrivateName(identifier.get());
>+        meta.setIsUsed();
>+        if (meta.isDeclared())
>+            find(identifier)->value.setIsCaptured();
>+    }
>+
>+    ALWAYS_INLINE PrivateNamesRange privateNames() const
>+    {
>+        ASSERT(privateNamesSize() > 0);
>+        return PrivateNamesRange(m_rareData->m_privateNames.begin(), m_rareData->m_privateNames.end());
>+    }
>+
>+    ALWAYS_INLINE unsigned privateNamesSize() const
>+    {
>+        if (!m_rareData)
>+            return 0;
>+        return m_rareData->m_privateNames.size();
>+    }
>+
>+    ALWAYS_INLINE bool hasPrivateName(const Identifier& identifier)
>+    {
>+        if (!m_rareData)
>+            return false;
>+        return m_rareData->m_privateNames.contains(identifier.impl());
>+    }
>+
>+    ALWAYS_INLINE void copyPrivateNames(VariableEnvironment& other) const
>+    {
>+        if (!m_rareData)
>+            return;
>+        if (!other.m_rareData)
>+            other.m_rareData = WTF::makeUnique<VariableEnvironment::RareData>();
>+        if (privateNamesSize() > 0) {
>+            for (auto entry : privateNames()) {
>+                if (!(entry.value.isUsed() && entry.value.isDeclared()))
>+                    other.m_rareData->m_privateNames.add(entry.key, entry.value);
>+            }
>+        }
>+    }
>+
>+    ALWAYS_INLINE void copyPrivateNameUses(VariableEnvironment& outer) const {
>+        // Used by the Parser to transfer recorded uses of PrivateNames from an
>+        // inner PrivateNameEnvironment into an outer one, in case a PNE is used
>+        // earlier in the source code than it is defined.
>+        if (privateNamesSize() > 0) {
>+            for (auto entry : privateNames()) {
>+                if (entry.value.isUsed() && !entry.value.isDeclared())
>+                    outer.getOrAddPrivateName(entry.key.get()).setIsUsed();
>+            }
>+        }
>+    }
>+
>+    struct RareData {
>+        WTF_MAKE_STRUCT_FAST_ALLOCATED;
>+
>+        RareData() { }
>+        RareData(RareData&& other)
>+            : m_privateNames(WTFMove(other.m_privateNames))
>+        {
>+        }
>+        RareData(const RareData&) = default;
>+        RareData& operator=(const RareData&) = default;
>+        PrivateNames m_privateNames;
>+    };
>+
> private:
>     friend class CachedVariableEnvironment;
> 
>     Map m_map;
>     bool m_isEverythingCaptured { false };
>+
>+    PrivateNameEntry& getOrAddPrivateName(UniquedStringImpl* impl)
>+    {
>+        if (!m_rareData)
>+            m_rareData = WTF::makeUnique<VariableEnvironment::RareData>();
>+
>+        auto it = m_rareData->m_privateNames.find(impl);
>+        if (it == m_rareData->m_privateNames.end())
>+            it = m_rareData->m_privateNames.add(impl, PrivateNameEntry(0)).iterator;
>+        return it->value;
>+    }
>+
>+    std::unique_ptr<VariableEnvironment::RareData> m_rareData;
> };
> 
> class CompactVariableEnvironment {
>diff --git a/Source/JavaScriptCore/runtime/CachedTypes.cpp b/Source/JavaScriptCore/runtime/CachedTypes.cpp
>index 81f560452202303e51a9e32cce39f1096590523d..045e4455fb6db4fa4a5dfaf8f70fe83e418dd270 100644
>--- a/Source/JavaScriptCore/runtime/CachedTypes.cpp
>+++ b/Source/JavaScriptCore/runtime/CachedTypes.cpp
>@@ -816,6 +816,12 @@ public:
>         else
>             encode(encoder, { *source });
>     }
>+
>+    SourceType<T>* decodeAsPtr(Decoder& decoder) const
>+    {
>+        RELEASE_ASSERT(!this->isEmpty());
>+        return this->template buffer<T>()->decode(decoder);
>+    }
> };
> 
> class CachedSimpleJumpTable : public CachedObject<UnlinkedSimpleJumpTable> {
>@@ -960,23 +966,45 @@ private:
>     CachedVector<CachedConstantIdentifierSetEntry> m_constantIdentifierSets;
> };
> 
>+class CachedVariableEnvironmentRareData : public CachedObject<VariableEnvironment::RareData> {
>+public:
>+    void encode(Encoder& encoder, const VariableEnvironment::RareData& rareData)
>+    {
>+        m_privateNames.encode(encoder, rareData.m_privateNames);
>+    }
>+
>+    void decode(Decoder& decoder, VariableEnvironment::RareData& rareData) const
>+    {
>+        m_privateNames.decode(decoder, rareData.m_privateNames);
>+    }
>+
>+private:
>+    CachedHashMap<CachedRefPtr<CachedUniquedStringImpl>, PrivateNameEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, PrivateNameEntryHashTraits> m_privateNames;
>+};
>+
> class CachedVariableEnvironment : public CachedObject<VariableEnvironment> {
> public:
>     void encode(Encoder& encoder, const VariableEnvironment& env)
>     {
>         m_isEverythingCaptured = env.m_isEverythingCaptured;
>         m_map.encode(encoder, env.m_map);
>+        m_rareData.encode(encoder, env.m_rareData.get());
>     }
> 
>     void decode(Decoder& decoder, VariableEnvironment& env) const
>     {
>         env.m_isEverythingCaptured = m_isEverythingCaptured;
>         m_map.decode(decoder, env.m_map);
>+        if (!m_rareData.isEmpty()) {
>+            env.m_rareData = WTF::makeUnique<VariableEnvironment::RareData>();
>+            m_rareData->decode(decoder, *env.m_rareData);
>+        }
>     }
> 
> private:
>     bool m_isEverythingCaptured;
>     CachedHashMap<CachedRefPtr<CachedUniquedStringImpl>, VariableEnvironmentEntry, IdentifierRepHash, HashTraits<RefPtr<UniquedStringImpl>>, VariableEnvironmentEntryHashTraits> m_map;
>+    CachedPtr<CachedVariableEnvironmentRareData> m_rareData;
> };
> 
> class CachedCompactVariableEnvironment : public CachedObject<CompactVariableEnvironment> {
>@@ -1103,6 +1131,22 @@ private:
>     intptr_t m_bits;
> };
> 
>+class CachedSymbolTableRareData : public CachedObject<SymbolTable::SymbolTableRareData> {
>+public:
>+    void encode(Encoder& encoder, const SymbolTable::SymbolTableRareData& rareData)
>+    {
>+        m_privateNames.encode(encoder, rareData.m_privateNames);
>+    }
>+
>+    void decode(Decoder& decoder, SymbolTable::SymbolTableRareData& rareData) const
>+    {
>+        m_privateNames.decode(decoder, rareData.m_privateNames);
>+    }
>+
>+private:
>+    CachedHashSet<CachedRefPtr<CachedUniquedStringImpl>, IdentifierRepHash> m_privateNames;
>+};
>+
> class CachedSymbolTable : public CachedObject<SymbolTable> {
> public:
>     void encode(Encoder& encoder, const SymbolTable& symbolTable)
>@@ -1113,6 +1157,7 @@ public:
>         m_nestedLexicalScope = symbolTable.m_nestedLexicalScope;
>         m_scopeType = symbolTable.m_scopeType;
>         m_arguments.encode(encoder, symbolTable.m_arguments.get());
>+        m_rareData.encode(encoder, symbolTable.m_rareData.get());
>     }
> 
>     SymbolTable* decode(Decoder& decoder) const
>@@ -1126,6 +1171,11 @@ public:
>         ScopedArgumentsTable* scopedArgumentsTable = m_arguments.decode(decoder);
>         if (scopedArgumentsTable)
>             symbolTable->m_arguments.set(decoder.vm(), symbolTable, scopedArgumentsTable);
>+        if (!m_rareData.isEmpty()) {
>+            symbolTable->m_rareData = WTF::makeUnique<SymbolTable::SymbolTableRareData>();
>+            m_rareData->decode(decoder, *symbolTable->m_rareData);
>+        }
>+
>         return symbolTable;
>     }
> 
>@@ -1136,6 +1186,7 @@ private:
>     unsigned m_nestedLexicalScope : 1;
>     unsigned m_scopeType : 3;
>     CachedPtr<CachedScopedArgumentsTable> m_arguments;
>+    CachedPtr<CachedSymbolTableRareData> m_rareData;
> };
> 
> class CachedJSValue;
>diff --git a/Source/JavaScriptCore/runtime/CodeCache.h b/Source/JavaScriptCore/runtime/CodeCache.h
>index 778094cd9409663eb9217e1944ffa1aa853bf443..3edc88439ed916d92435d7f3580b8e1b840ea1ac 100644
>--- a/Source/JavaScriptCore/runtime/CodeCache.h
>+++ b/Source/JavaScriptCore/runtime/CodeCache.h
>@@ -276,7 +276,7 @@ UnlinkedCodeBlockType* generateUnlinkedCodeBlockImpl(VM& vm, const SourceCode& s
> {
>     typedef typename CacheTypes<UnlinkedCodeBlockType>::RootNode RootNode;
>     std::unique_ptr<RootNode> rootNode = parse<RootNode>(
>-        vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin, strictMode, scriptMode, CacheTypes<UnlinkedCodeBlockType>::parseMode, SuperBinding::NotNeeded, error, nullptr, ConstructorKind::None, derivedContextType, evalContextType);
>+        vm, source, Identifier(), JSParserBuiltinMode::NotBuiltin, strictMode, scriptMode, CacheTypes<UnlinkedCodeBlockType>::parseMode, SuperBinding::NotNeeded, error, nullptr, ConstructorKind::None, derivedContextType, evalContextType, nullptr, variablesUnderTDZ);
>     if (!rootNode)
>         return nullptr;
> 
>diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp b/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp
>index c63a0291117295d1919ba2802a2c390ac5166708..5778071be4eab3f43eb8b807fa45e3bb6ec99f60 100644
>--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp
>+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.cpp
>@@ -32,6 +32,7 @@ namespace JSC {
> #define INITIALIZE_KEYWORD(name) , name##Keyword(Identifier::fromString(vm, #name))
> #define INITIALIZE_PRIVATE_NAME(name) , name##PrivateName(m_builtinNames->name##PrivateName())
> #define INITIALIZE_SYMBOL(name) , name##Symbol(m_builtinNames->name##Symbol())
>+#define INITIALIZE_PRIVATE_FIELD_NAME(name) , name##PrivateField(Identifier::fromString(vm, "#" #name))
> 
> CommonIdentifiers::CommonIdentifiers(VM& vm)
>     : nullIdentifier()
>@@ -45,6 +46,7 @@ CommonIdentifiers::CommonIdentifiers(VM& vm)
>     JSC_COMMON_IDENTIFIERS_EACH_KEYWORD(INITIALIZE_KEYWORD)
>     JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(INITIALIZE_PROPERTY_NAME)
>     JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_SYMBOL)
>+    JSC_COMMON_IDENTIFIERS_EACH_PRIVATE_FIELD(INITIALIZE_PRIVATE_FIELD_NAME)
> {
> }
> 
>diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.h b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
>index 07cc7ac4a942aa0ee9d9af6ffa3ca3974c832caa..118d4a68206ec2ba807357a088322d5b7f50c474 100644
>--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.h
>+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
>@@ -202,6 +202,9 @@
>     macro(writable) \
>     macro(year)
> 
>+#define JSC_COMMON_IDENTIFIERS_EACH_PRIVATE_FIELD(macro) \
>+    macro(constructor)
>+
> #define JSC_COMMON_IDENTIFIERS_EACH_KEYWORD(macro) \
>     macro(await) \
>     macro(break) \
>@@ -316,6 +319,10 @@ namespace JSC {
>         JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(JSC_IDENTIFIER_DECLARE_PRIVATE_WELL_KNOWN_SYMBOL_GLOBAL)
> #undef JSC_IDENTIFIER_DECLARE_PRIVATE_WELL_KNOWN_SYMBOL_GLOBAL
> 
>+#define JSC_IDENTIFIER_DECLARE_PRIVATE_FIELD_GLOBAL(name) const Identifier name##PrivateField;
>+        JSC_COMMON_IDENTIFIERS_EACH_PRIVATE_FIELD(JSC_IDENTIFIER_DECLARE_PRIVATE_FIELD_GLOBAL)
>+#undef JSC_IDENTIFIER_DECLARE_PRIVATE_FIELD_GLOBAL
>+
>         SymbolImpl* lookUpPrivateName(const Identifier&) const;
>         Identifier getPublicName(VM&, SymbolImpl*) const;
> 
>diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>index 716fe82fa282a7f47b14d501540d290a4a9d143a..29981492e4f4781863d3b8fa9e87ece60007992b 100644
>--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>@@ -1287,6 +1287,72 @@ SLOW_PATH_DECL(slow_path_get_by_val_with_this)
>     RETURN_PROFILED(baseValue.get(globalObject, property, slot));
> }
> 
>+SLOW_PATH_DECL(slow_path_get_by_val_direct)
>+{
>+    BEGIN();
>+
>+    auto bytecode = pc->as<OpGetByValDirect>();
>+    JSValue baseValue = GET_C(bytecode.m_base).jsValue();
>+    JSValue subscript = GET_C(bytecode.m_property).jsValue();
>+
>+    if (LIKELY(baseValue.isCell() && subscript.isString())) {
>+        Structure& structure = *baseValue.asCell()->structure(vm);
>+        if (JSCell::canUseFastGetOwnProperty(structure)) {
>+            RefPtr<AtomStringImpl> existingAtomString = asString(subscript)->toExistingAtomString(globalObject);
>+            CHECK_EXCEPTION();
>+            if (existingAtomString) {
>+                if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomString.get()))
>+                    RETURN_PROFILED(result);
>+            }
>+        }
>+    }
>+
>+    if (subscript.isUInt32()) {
>+        uint32_t i = subscript.asUInt32();
>+        auto& metadata = bytecode.metadata(codeBlock);
>+        ArrayProfile* arrayProfile = &metadata.m_arrayProfile;
>+
>+        if (isJSString(baseValue)) {
>+            if (asString(baseValue)->canGetIndex(i))
>+                RETURN_PROFILED(asString(baseValue)->getIndex(globalObject, i));
>+            arrayProfile->setOutOfBounds();
>+        } else if (baseValue.isObject()) {
>+            JSObject* object = asObject(baseValue);
>+            if (object->canGetIndexQuickly(i))
>+                RETURN_PROFILED(object->getIndexQuickly(i));
>+
>+            bool skipMarkingOutOfBounds = false;
>+
>+            if (object->indexingType() == ArrayWithContiguous && i < object->butterfly()->publicLength()) {
>+                // FIXME: expand this to ArrayStorage, Int32, and maybe Double:
>+                // https://bugs.webkit.org/show_bug.cgi?id=182940
>+                auto* globalObject = object->globalObject(vm);
>+                skipMarkingOutOfBounds = globalObject->isOriginalArrayStructure(object->structure(vm)) && globalObject->arrayPrototypeChainIsSane();
>+            }
>+
>+            if (!skipMarkingOutOfBounds && !CommonSlowPaths::canAccessArgumentIndexQuickly(*object, i))
>+                arrayProfile->setOutOfBounds();
>+        }
>+
>+        RETURN_PROFILED(jsUndefined());
>+    }
>+
>+    baseValue.requireObjectCoercible(globalObject);
>+    CHECK_EXCEPTION();
>+    auto property = subscript.toPropertyKey(globalObject);
>+    CHECK_EXCEPTION();
>+
>+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::GetOwnProperty);
>+
>+    bool found = (baseValue.asCell()->isProxy() && property.isPrivateName())
>+        ? JSObject::getOwnPropertySlot(asObject(baseValue), globalObject, property, slot)
>+        : baseValue.getOwnPropertySlot(globalObject, property, slot);
>+    CHECK_EXCEPTION();
>+    if (!found && property.isPrivateName())
>+        THROW(createInvalidPrivateNameError(globalObject));
>+    RETURN_PROFILED(found ? slot.getValue(globalObject, property) : jsUndefined());
>+}
>+
> SLOW_PATH_DECL(slow_path_put_by_id_with_this)
> {
>     BEGIN();
>diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.h b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
>index 8964b7fae27c8fe579915aaf594683ccef1892aa..ad5ce62080519db2248fa9f2160eae235913e3f2 100644
>--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.h
>+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
>@@ -389,6 +389,7 @@ SLOW_PATH_HIDDEN_DECL(slow_path_create_async_generator);
> SLOW_PATH_HIDDEN_DECL(slow_path_create_rest);
> SLOW_PATH_HIDDEN_DECL(slow_path_get_by_id_with_this);
> SLOW_PATH_HIDDEN_DECL(slow_path_get_by_val_with_this);
>+SLOW_PATH_HIDDEN_DECL(slow_path_get_by_val_direct);
> SLOW_PATH_HIDDEN_DECL(slow_path_put_by_id_with_this);
> SLOW_PATH_HIDDEN_DECL(slow_path_put_by_val_with_this);
> SLOW_PATH_HIDDEN_DECL(slow_path_define_data_property);
>diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>index eed449643f31b67ef19c4ba00774f48a2cdfc7dd..2db8c95abc807b5b1461cb8eb8ed1628282c3f91 100644
>--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>@@ -326,6 +326,16 @@ JSObject* createTDZError(JSGlobalObject* globalObject)
>     return createReferenceError(globalObject, "Cannot access uninitialized variable.");
> }
> 
>+JSObject* createInvalidPrivateNameError(JSGlobalObject* globalObject)
>+{
>+    return createTypeError(globalObject, makeString("Cannot access invalid private field"), defaultSourceAppender, TypeNothing);
>+}
>+
>+JSObject* createRedefinedPrivateNameError(JSGlobalObject* globalObject)
>+{
>+    return createTypeError(globalObject, makeString("Cannot redefine existing private field"), defaultSourceAppender, TypeNothing);
>+}
>+
> Exception* throwOutOfMemoryError(JSGlobalObject* globalObject, ThrowScope& scope)
> {
>     return throwException(globalObject, scope, createOutOfMemoryError(globalObject));
>diff --git a/Source/JavaScriptCore/runtime/ExceptionHelpers.h b/Source/JavaScriptCore/runtime/ExceptionHelpers.h
>index 35ad12554c70127e4bfb7551ebb3c178eeb4c6e1..02130aebaa28b77f79c16e01f2963155b82a79a9 100644
>--- a/Source/JavaScriptCore/runtime/ExceptionHelpers.h
>+++ b/Source/JavaScriptCore/runtime/ExceptionHelpers.h
>@@ -53,6 +53,8 @@ JSObject* createInvalidInstanceofParameterErrorHasInstanceValueNotFunction(JSGlo
> JSObject* createNotAConstructorError(JSGlobalObject*, JSValue);
> JSObject* createNotAFunctionError(JSGlobalObject*, JSValue);
> JSObject* createErrorForInvalidGlobalAssignment(JSGlobalObject*, const String&);
>+JSObject* createInvalidPrivateNameError(JSGlobalObject*);
>+JSObject* createRedefinedPrivateNameError(JSGlobalObject*);
> String errorDescriptionForValue(JSGlobalObject*, JSValue);
> 
> JS_EXPORT_PRIVATE Exception* throwOutOfMemoryError(JSGlobalObject*, ThrowScope&);
>diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>index bc83b71c3bcb38f6d65607a25d99a1b8f1d02cdf..9a7dcf67a456cabaefcfe52cbb7ca6db2ad3d65c 100644
>--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>@@ -296,6 +296,13 @@ static EncodedJSValue JSC_HOST_CALL hasOwnLengthProperty(JSGlobalObject* globalO
>     return JSValue::encode(jsBoolean(target->hasOwnProperty(globalObject, vm.propertyNames->length)));
> }
> 
>+static EncodedJSValue JSC_HOST_CALL createPrivateSymbol(JSGlobalObject* globalObject, CallFrame*)
>+{
>+    VM& vm = globalObject->vm();
>+    return JSValue::encode(Symbol::create(vm, PrivateSymbolImpl::createNullSymbol().get()));
>+}
>+
>+
> #if !ASSERT_DISABLED
> static EncodedJSValue JSC_HOST_CALL assertCall(JSGlobalObject* globalObject, CallFrame* callFrame)
> {
>@@ -1151,6 +1158,12 @@ capitalName ## Constructor* lowerName ## Constructor = featureFlag ? capitalName
>             init.set(JSFunction::create(init.vm, jsCast<JSGlobalObject*>(init.owner), 0, String(), globalFuncDateTimeFormat));
>         });
> #endif // ENABLE(INTL)
>+
>+    // PrivateSymbols / PrivateNames
>+    m_linkTimeConstants[static_cast<unsigned>(LinkTimeConstant::createPrivateSymbol)].initLater([] (const Initializer<JSCell>& init) {
>+            init.set(JSFunction::create(init.vm, jsCast<JSGlobalObject*>(init.owner), 0, String(), createPrivateSymbol));
>+        });
>+
> #if ENABLE(WEBASSEMBLY) && ENABLE(WEBASSEMBLY_STREAMING_API)
>     // WebAssembly Streaming API
>     m_linkTimeConstants[static_cast<unsigned>(LinkTimeConstant::webAssemblyCompileStreamingInternal)].initLater([] (const Initializer<JSCell>& init) {
>diff --git a/Source/JavaScriptCore/runtime/JSScope.cpp b/Source/JavaScriptCore/runtime/JSScope.cpp
>index 6d5ab682c683914f69f3e5c228384fefe46577c8..e70c0bc7bb0c3af2b94aad75d1802898d22171a2 100644
>--- a/Source/JavaScriptCore/runtime/JSScope.cpp
>+++ b/Source/JavaScriptCore/runtime/JSScope.cpp
>@@ -339,6 +339,11 @@ void JSScope::collectClosureVariablesUnderTDZ(JSScope* scope, VariableEnvironmen
>         ConcurrentJSLocker locker(symbolTable->m_lock);
>         for (auto end = symbolTable->end(locker), iter = symbolTable->begin(locker); iter != end; ++iter)
>             result.add(iter->key);
>+        if (symbolTable->hasPrivateNames()) {
>+            auto privateNames = symbolTable->privateNames();
>+            for (auto end = privateNames.end(), iter = privateNames.begin(); iter != end; ++iter)
>+                result.usePrivateName(*iter);
>+        }
>     }
> }
> 
>diff --git a/Source/JavaScriptCore/runtime/SymbolTable.cpp b/Source/JavaScriptCore/runtime/SymbolTable.cpp
>index b0363772a80644e97a934d9085bd76cc97032812..14522bfd58dd8b72420d3b8a9fd91a3bc0a62182 100644
>--- a/Source/JavaScriptCore/runtime/SymbolTable.cpp
>+++ b/Source/JavaScriptCore/runtime/SymbolTable.cpp
>@@ -181,6 +181,13 @@ SymbolTable* SymbolTable::cloneScopePart(VM& vm)
>             for (; iter != end; ++iter)
>                 result->m_rareData->m_uniqueTypeSetMap.set(iter->key, iter->value);
>         }
>+
>+        {
>+            auto iter = m_rareData->m_privateNames.begin();
>+            auto end = m_rareData->m_privateNames.end();
>+            for (; iter != end; ++iter)
>+                result->m_rareData->m_privateNames.add(*iter);
>+        }
>     }
>     
>     return result;
>diff --git a/Source/JavaScriptCore/runtime/SymbolTable.h b/Source/JavaScriptCore/runtime/SymbolTable.h
>index 1e4c64cbbb9450e94243e55a0da70127845fff30..29d6caf373e2f708df0780a1d5e09c96d19b9223 100644
>--- a/Source/JavaScriptCore/runtime/SymbolTable.h
>+++ b/Source/JavaScriptCore/runtime/SymbolTable.h
>@@ -38,7 +38,7 @@
> #include "Watchpoint.h"
> #include <memory>
> #include <wtf/HashTraits.h>
>-#include <wtf/text/UniquedStringImpl.h>
>+#include <wtf/text/SymbolImpl.h>
> 
> namespace JSC {
> 
>@@ -448,6 +448,8 @@ public:
>     typedef HashMap<RefPtr<UniquedStringImpl>, RefPtr<TypeSet>, IdentifierRepHash> UniqueTypeSetMap;
>     typedef HashMap<VarOffset, RefPtr<UniquedStringImpl>> OffsetToVariableMap;
>     typedef Vector<SymbolTableEntry*> LocalToEntryVec;
>+    typedef HashSet<RefPtr<UniquedStringImpl>, IdentifierRepHash> PrivateNameSet;
>+    typedef WTF::IteratorRange<typename PrivateNameSet::iterator> PrivateNameIteratorRange;
> 
>     template<typename CellType, SubspaceAccess>
>     static IsoSubspace* subspaceFor(VM& vm)
>@@ -592,7 +594,28 @@ public:
>         ConcurrentJSLocker locker(m_lock);
>         add(locker, key, std::forward<Entry>(entry));
>     }
>-    
>+
>+    bool hasPrivateNames() const { return m_rareData && m_rareData->m_privateNames.size(); }
>+    ALWAYS_INLINE PrivateNameIteratorRange privateNames()
>+    {
>+        PrivateNameSet::iterator begin, end;
>+        if (m_rareData) {
>+            begin = m_rareData->m_privateNames.begin();
>+            end = m_rareData->m_privateNames.end();
>+        }
>+        return PrivateNameIteratorRange(begin, end);
>+    }
>+
>+    void addPrivateName(UniquedStringImpl* key)
>+    {
>+        ASSERT(key && !key->isSymbol());
>+        if (!m_rareData)
>+            m_rareData = WTF::makeUnique<SymbolTableRareData>();
>+
>+        ASSERT(!m_rareData->m_privateNames.contains(key));
>+        m_rareData->m_privateNames.add(key);
>+    }
>+
>     template<typename Entry>
>     void set(const ConcurrentJSLocker&, UniquedStringImpl* key, Entry&& entry)
>     {
>@@ -715,18 +738,21 @@ private:
>     ScopeOffset m_maxScopeOffset;
> public:
>     mutable ConcurrentJSLock m_lock;
>-private:
>-    unsigned m_usesNonStrictEval : 1;
>-    unsigned m_nestedLexicalScope : 1; // Non-function LexicalScope.
>-    unsigned m_scopeType : 3; // ScopeType
>-    
>+
>     struct SymbolTableRareData {
>         WTF_MAKE_STRUCT_FAST_ALLOCATED;
>         UniqueIDMap m_uniqueIDMap;
>         OffsetToVariableMap m_offsetToVariableMap;
>         UniqueTypeSetMap m_uniqueTypeSetMap;
>         WriteBarrier<CodeBlock> m_codeBlock;
>+        PrivateNameSet m_privateNames;
>     };
>+
>+private:
>+    unsigned m_usesNonStrictEval : 1;
>+    unsigned m_nestedLexicalScope : 1; // Non-function LexicalScope.
>+    unsigned m_scopeType : 3; // ScopeType
>+
>     std::unique_ptr<SymbolTableRareData> m_rareData;
> 
>     WriteBarrier<ScopedArgumentsTable> m_arguments;
>diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
>index 4d5e4a7449c6cb88e9a03bb7c56310c8b8b1e202..0349d6b018df83da6f6b6c8e11522cf5b712099c 100644
>--- a/JSTests/ChangeLog
>+++ b/JSTests/ChangeLog
>@@ -1,3 +1,25 @@
>+2019-11-19  Caitlin Potter <caitp@igalia.com>
>+
>+        [JSC] Add support for private class fields
>+        https://bugs.webkit.org/show_bug.cgi?id=174212
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Expands upon the earlier public fields patch, adding a number of private
>+        field tests.
>+
>+        * stress/class-fields-private-as-function.js: Added.
>+        * stress/class-fields-private-cached-bytecode.js: Added.
>+        * stress/class-fields-private-on-proxy.js: Added.
>+        * stress/class-fields-private-out-of-line.js: Added.
>+        * stress/class-fields-private-use-eval.js: Added.
>+        * stress/class-fields-stress-instance.js:
>+        * stress/get-by-val-direct-getprivate.js: Added.
>+        * stress/private-name-access-in-computed-property.js: Added.
>+        * stress/put-by-val-direct-addprivate.js: Added.
>+        * stress/put-by-val-direct-putprivate.js: Added.
>+        * test262/config.yaml:
>+
> 2019-11-26  Caitlin Potter  <caitp@igalia.com>
> 
>         [JSC] Add support for public class fields
>diff --git a/JSTests/stress/class-fields-private-as-function.js b/JSTests/stress/class-fields-private-as-function.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..8e9aed4d1a31be0a82bcf0980231f0bcbd510cc5
>--- /dev/null
>+++ b/JSTests/stress/class-fields-private-as-function.js
>@@ -0,0 +1,18 @@
>+//@ requireOptions("--useClassFields=1")
>+
>+function assert(a, e) {
>+    if (a !== e)
>+        throw new Error("Expected: " + e + " but got: " + a);
>+}
>+
>+class C {
>+    #m = () => 25;
>+
>+    method() {
>+        return this.#m();
>+    }
>+}
>+
>+let c = new C();
>+assert(c.method(), 25);
>+
>diff --git a/JSTests/stress/class-fields-private-cached-bytecode.js b/JSTests/stress/class-fields-private-cached-bytecode.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..4708698f65199e769929dfd9ed2a55b563abe085
>--- /dev/null
>+++ b/JSTests/stress/class-fields-private-cached-bytecode.js
>@@ -0,0 +1,18 @@
>+//@ runBytecodeCache("--useClassFields=true")
>+
>+function assert(a, e) {
>+    if (a !== e)
>+        throw new Error("Expected: " + e + " but got: " + a);
>+}
>+
>+class C {
>+    #f = 3;
>+
>+    method() {
>+        return this.#f;
>+    }
>+}
>+
>+let c = new C();
>+assert(c.method(), 3);
>+
>diff --git a/JSTests/stress/class-fields-private-on-proxy.js b/JSTests/stress/class-fields-private-on-proxy.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..77f04e6d54a66ef52bd5fd313db77b3262cfee9f
>--- /dev/null
>+++ b/JSTests/stress/class-fields-private-on-proxy.js
>@@ -0,0 +1,39 @@
>+//@ requireOptions("--useClassFields=1")
>+
>+function assert(a, e, m) {
>+    if (a !== e)
>+        throw new Error(m);
>+}
>+
>+function assertArrayContent(a, e) {
>+    assert(a.length, e.length, "Size of arrays doesn't match");
>+    for (var i = 0; i < a.length; i++)
>+        assert(a[i], e[i], "a[" + i + "] = " + a[i] + " but e[" + i + "] = " + e[i]);
>+}
>+
>+let arr = [];
>+
>+class ProxyBase {
>+    constructor() {
>+        return new Proxy(this, {
>+            get: function (obj, prop) {
>+                arr.push(prop);
>+                return obj[prop];
>+            }
>+        });
>+    }
>+}
>+
>+class Test extends ProxyBase {
>+    #f = 3;
>+    method() {
>+        return this.#f;
>+    }
>+}
>+
>+let t = new Test();
>+let r = t.method();
>+assert(r, 3, "Expected: 3 but got: " + r);
>+
>+assertArrayContent(arr, ['method']);
>+
>diff --git a/JSTests/stress/class-fields-private-out-of-line.js b/JSTests/stress/class-fields-private-out-of-line.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..6644d6b213bca5859beb7c2eb62e468d2cbe7be6
>--- /dev/null
>+++ b/JSTests/stress/class-fields-private-out-of-line.js
>@@ -0,0 +1,28 @@
>+//@ requireOptions("--useClassFields=true")
>+
>+function assert(a, e) {
>+    if (a !== e)
>+        throw new Error("Expected: " + e + " but got: " + a);
>+}
>+
>+let klassSource = `
>+var C = class {
>+    assertOutOfLineValue() {
>+        assert(this.#f200, "foo");
>+    }
>+`;
>+
>+
>+for (let i = 0; i < 200; i++) {
>+    klassSource += "    #f" + i + ";\n";
>+}
>+
>+klassSource += "    #f200 = \"foo\";\n}";
>+
>+eval(klassSource);
>+
>+for (let i = 0; i < 2; i++) {
>+    let c = new C();
>+    c.assertOutOfLineValue();
>+}
>+
>diff --git a/JSTests/stress/class-fields-private-use-eval.js b/JSTests/stress/class-fields-private-use-eval.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..ea0696baccf9270ceae0eb9327e40cd098996a12
>--- /dev/null
>+++ b/JSTests/stress/class-fields-private-use-eval.js
>@@ -0,0 +1,15 @@
>+//@ requireOptions("--useClassFields=true")
>+
>+function assert(a, message) {
>+    if (!a)
>+        throw new Error(message);
>+}
>+
>+let inst = new class {
>+  a = eval("(i) => i.#b");
>+
>+  #b = {};
>+};
>+
>+inst.a(inst).x = 1;
>+assert(inst.a(inst).x == 1);
>diff --git a/JSTests/stress/class-fields-stress-instance.js b/JSTests/stress/class-fields-stress-instance.js
>index 56624fbeedbb028b94e0d6e611fe49936d25258f..3c9b588ebec9f4b6d2a691c4f7d6b8c35ad933ee 100644
>--- a/JSTests/stress/class-fields-stress-instance.js
>+++ b/JSTests/stress/class-fields-stress-instance.js
>@@ -3,9 +3,13 @@
> class A {
>     a = 0;
>     b = 1;
>+    #c = 0;
>+    #d = 1;
>     e = function () { return 0; };
>+    #f = function() { return 1; };
>     ["g"] = 0;
>     h = eval("true");
>+    #i = eval("false");
> }
> 
> for (var i = 0; i < 10000; i++)
>diff --git a/JSTests/stress/get-by-val-direct-getprivate.js b/JSTests/stress/get-by-val-direct-getprivate.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..ff778caf2f837794bbfe4fc0a470be940755cca3
>--- /dev/null
>+++ b/JSTests/stress/get-by-val-direct-getprivate.js
>@@ -0,0 +1,29 @@
>+// TODO: //@ requireOptions("--useClassFields=1")
>+//@ runNoJIT("--useClassFields=1")
>+//@ runNoLLInt("--useClassFields=1")
>+
>+// GetByValDirect should throw when the receiver does not have the requested private property
>+let i, threw = false;
>+class C {
>+    #x = i;
>+    constructor() { if (i === 30) return { [Symbol.toStringTag]: "without #x"}; }
>+    static x(obj) { return obj.#x; }
>+    get [Symbol.toStringTag]() { return "with #x"; }
>+}
>+
>+try {
>+    for (i = 0; i < 50; ++i) {
>+        let c = new C;
>+        let result = C.x(c);
>+        if (result !== i)
>+            throw new Error(`Expected C.x(${c}) to be ${i}, but found ${result}`);
>+    }
>+} catch (e) {
>+    threw = true;
>+    if (i !== 30 || e.constructor !== TypeError) {
>+        throw e;
>+    }
>+}
>+
>+if (!threw)
>+    throw new Error("Expected TypeError, but no exception was thrown");
>diff --git a/JSTests/stress/private-name-access-in-computed-property.js b/JSTests/stress/private-name-access-in-computed-property.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..84cd016a551abb57877e2a7475f9be0275669102
>--- /dev/null
>+++ b/JSTests/stress/private-name-access-in-computed-property.js
>@@ -0,0 +1,20 @@
>+//@ requireOptions("--useClassFields=1")
>+
>+let assert = {
>+    throws: (expectedError, functor) => {
>+        try {
>+            functor();
>+        } catch(e) {
>+            if (!(e instanceof expectedError))
>+                throw new Error("Expected to throw: " + expectedError.name + " but throws: " + e.name);
>+        }
>+    }
>+}
>+
>+assert.throws(TypeError, () => {
>+    class Base {
>+        [{}.#x] = 1; 
>+        #x = "foo";
>+    }
>+});
>+
>diff --git a/JSTests/stress/put-by-val-direct-addprivate.js b/JSTests/stress/put-by-val-direct-addprivate.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..dff9495f9569d4f820a34d25e05c13fde89bfaa3
>--- /dev/null
>+++ b/JSTests/stress/put-by-val-direct-addprivate.js
>@@ -0,0 +1,34 @@
>+// TODO: //@ requireOptions("--useClassFields=1")
>+//@ runDefault("--useClassFields=1")
>+//@ runNoJIT("--useClassFields=1")
>+//@ runNoLLInt("--useClassFields=1")
>+
>+// GPVD with "PutByValThrowIfExists" should throw if overwriting an already existing PrivateName.
>+let c, i = 0, threw = false;
>+class C {
>+    constructor() {
>+        return i < 29 ? this : c;
>+    }
>+}
>+
>+class CC extends C {
>+    #x = i++;
>+    x() { return this.#x; }
>+}
>+
>+c = new CC;
>+try {
>+    for (let j = 1; j < 50; ++j) {
>+        let x = new CC;
>+        if (x.x() !== j)
>+            throw new Error(`Expected x.x() to be ${j}, but found ${x.x()}`);
>+    }
>+} catch (e) {
>+    threw = true;
>+    if (i !== 30 || e.constructor !== TypeError) {
>+        throw e;
>+    }
>+}
>+
>+if (!threw)
>+    throw new Error("Expected TypeError, but no exception was thrown");
>diff --git a/JSTests/stress/put-by-val-direct-putprivate.js b/JSTests/stress/put-by-val-direct-putprivate.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..b528ee5c1362934950e74ba22cd75dd655337a87
>--- /dev/null
>+++ b/JSTests/stress/put-by-val-direct-putprivate.js
>@@ -0,0 +1,29 @@
>+// TODO: //@ requireOptions("--useClassFields=1")
>+//@ runNoJIT("--useClassFields=1")
>+//@ runNoLLInt("--useClassFields=1")
>+
>+// GPVD with "PutByValPrivateName" should throw if writing to a non-existent PrivateName.
>+let c, i = 0, threw = false;
>+class C {
>+    #x = i++;
>+    constructor() { return i < 30 ? this : { [Symbol.toStringTag]: "without #x" }; }
>+    static x(obj) { return obj.#x; }
>+    get [Symbol.toStringTag]() { return "with #x" }
>+}
>+
>+try {
>+    for (let j = 0; j < 50; ++j) {
>+        let obj = new C;
>+        let result = C.x(obj);
>+        if (result !== j)
>+            throw new Error(`Expected C.x(${obj}) to be ${j}, but found ${result}`);
>+    }
>+} catch (e) {
>+    threw = true;
>+    if (i !== 30 || e.constructor !== TypeError) {
>+        throw e;
>+    }
>+}
>+
>+if (!threw)
>+    throw new Error("Expected TypeError, but no exception was thrown");
>diff --git a/JSTests/test262/config.yaml b/JSTests/test262/config.yaml
>index 23835813be391e2a3b503f078f483ab3d0b8d228..75e408c63fca6ae2816f29dc6dc6f1c893a52c08 100644
>--- a/JSTests/test262/config.yaml
>+++ b/JSTests/test262/config.yaml
>@@ -3,6 +3,7 @@
> flags:
>   BigInt: useBigInt
>   WeakRef: useWeakRefs
>+  class-fields-private: useClassFields
>   class-fields-public: useClassFields
> skip:
>   features:
>@@ -11,7 +12,6 @@ skip:
>     # https://bugs.webkit.org/show_bug.cgi?id=174931
>     - regexp-lookbehind
> 
>-    - class-fields-private
>     - class-methods-private
>     - class-static-fields-public
>     - class-static-fields-private

Actions: View | Formatted Diff | Diff

Attachments on bug 174212: 314736 | 327359 | 335960 | 344172 | 344176 | 348905 | 348907 | 350893 | 350896 | 350917 | 350923 | 350924 | 350925 | 350935 | 350962 | 351261 | 351286 | 351354 | 353696 | 353698 | 353699 | 353848 | 353849 | 353857 | 353954 | 356594 | 356595 | 360454 | 366588 | 367749 | 368117 | 369295 | 369383 | 371258 | 371265 | 371266 | 371267 | 371268 | 371270 | 371272 | 371273 | 371276 | 371277 | 371278 | 371383 | 371384 | 371387 | 371392 | 373112 | 373117 | 373142 | 373153 | 380353 | 380552 | 380560 | 380757 | 380826 | 381427 | 381457 | 381711 | 382314 | 382318 | 383468 | 384358 | 384359 | 384927 | 384930 | 385494 | 385496 | 387356 | 387361 | 387363 | 387818 | 387827 | 387927