LibJS/Bytecode: Use proper this for receiver in get/set for super expr

Summary:
    Diff Tests:
        +14 ✅    -2 ❌    -12 📝

Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp

@@ -377,13 +377,30 @@ Bytecode::CodeGenerationErrorOr<void> AssignmentExpression::generate_bytecode(By
                 // b. ReturnIfAbrupt(lref).
                 Optional<Bytecode::Register> base_object_register;
                 Optional<Bytecode::Register> computed_property_register;
+                Optional<Bytecode::Register> this_value_register;
+
+                bool lhs_is_super_expression = false;
 
                 if (is<MemberExpression>(*lhs)) {
                     auto& expression = static_cast<MemberExpression const&>(*lhs);
-                    TRY(expression.object().generate_bytecode(generator));
+                    lhs_is_super_expression = is<SuperExpression>(expression.object());
-
                     base_object_register = generator.allocate_register();
-                    generator.emit<Bytecode::Op::Store>(*base_object_register);
+
+                    if (!lhs_is_super_expression) {
+                        TRY(expression.object().generate_bytecode(generator));
+                        generator.emit<Bytecode::Op::Store>(*base_object_register);
+                    } else {
+                        // https://tc39.es/ecma262/#sec-super-keyword-runtime-semantics-evaluation
+                        // 1. Let env be GetThisEnvironment().
+                        // 2. Let actualThis be ? env.GetThisBinding().
+                        this_value_register = generator.allocate_register();
+                        generator.emit<Bytecode::Op::ResolveThisBinding>();
+                        generator.emit<Bytecode::Op::Store>(*this_value_register);
+
+                        // SuperProperty : super [ Expression ]
+                        // 3. Let propertyNameReference be ? Evaluation of Expression.
+                        // 4. Let propertyNameValue be ? GetValue(propertyNameReference).
+                    }
 
                     if (expression.is_computed()) {
                         TRY(expression.property().generate_bytecode(generator));
@@ -401,6 +418,18 @@ Bytecode::CodeGenerationErrorOr<void> AssignmentExpression::generate_bytecode(By
                             "Unimplemented non-computed member expression"sv
                         };
                     }
+
+                    if (lhs_is_super_expression) {
+                        // 5/7. Return ? MakeSuperPropertyReference(actualThis, propertyKey, strict).
+
+                        // https://tc39.es/ecma262/#sec-makesuperpropertyreference
+                        // 1. Let env be GetThisEnvironment().
+                        // 2. Assert: env.HasSuperBinding() is true.
+                        // 3. Let baseValue be ? env.GetSuperBase().
+                        // 4. Return the Reference Record { [[Base]]: baseValue, [[ReferencedName]]: propertyKey, [[Strict]]: strict, [[ThisValue]]: actualThis }.
+                        generator.emit<Bytecode::Op::ResolveSuperBase>();
+                        generator.emit<Bytecode::Op::Store>(*base_object_register);
+                    }
                 } else if (is<Identifier>(*lhs)) {
                     // NOTE: For Identifiers, we cannot perform GetVariable and then write into the reference it retrieves, only SetVariable can do this.
                     // FIXME: However, this breaks spec as we are doing variable lookup after evaluating the RHS. This is observable in an object environment, where we visibly perform HasOwnProperty and Get(@@unscopables) on the binded object.
@@ -428,10 +457,16 @@ Bytecode::CodeGenerationErrorOr<void> AssignmentExpression::generate_bytecode(By
                     auto& expression = static_cast<MemberExpression const&>(*lhs);
 
                     if (expression.is_computed()) {
-                        generator.emit<Bytecode::Op::PutByValue>(*base_object_register, *computed_property_register);
+                        if (!lhs_is_super_expression)
+                            generator.emit<Bytecode::Op::PutByValue>(*base_object_register, *computed_property_register);
+                        else
+                            generator.emit<Bytecode::Op::PutByValueWithThis>(*base_object_register, *computed_property_register, *this_value_register);
                     } else if (expression.property().is_identifier()) {
                         auto identifier_table_ref = generator.intern_identifier(verify_cast<Identifier>(expression.property()).string());
-                        generator.emit<Bytecode::Op::PutById>(*base_object_register, identifier_table_ref);
+                        if (!lhs_is_super_expression)
+                            generator.emit<Bytecode::Op::PutById>(*base_object_register, identifier_table_ref);
+                        else
+                            generator.emit<Bytecode::Op::PutByIdWithThis>(*base_object_register, *this_value_register, identifier_table_ref);
                     } else if (expression.property().is_private_identifier()) {
                         auto identifier_table_ref = generator.intern_identifier(verify_cast<PrivateIdentifier>(expression.property()).string());
                         generator.emit<Bytecode::Op::PutPrivateById>(*base_object_register, identifier_table_ref);
@@ -1435,11 +1470,11 @@ static Bytecode::CodeGenerationErrorOr<void> get_base_and_value_from_member_expr
             auto super_base_register = generator.allocate_register();
             generator.emit<Bytecode::Op::Store>(super_base_register);
             generator.emit<Bytecode::Op::Load>(*computed_property_value_register);
-            generator.emit<Bytecode::Op::GetByValue>(super_base_register);
+            generator.emit<Bytecode::Op::GetByValueWithThis>(super_base_register, this_reg);
         } else {
             // 3. Let propertyKey be StringValue of IdentifierName.
             auto identifier_table_ref = generator.intern_identifier(verify_cast<Identifier>(member_expression.property()).string());
-            generator.emit<Bytecode::Op::GetById>(identifier_table_ref);
+            generator.emit<Bytecode::Op::GetByIdWithThis>(identifier_table_ref, this_reg);
         }
     } else {
         TRY(member_expression.object().generate_bytecode(generator));

Userland/Libraries/LibJS/Bytecode/Generator.cpp

@@ -151,8 +151,9 @@ CodeGenerationErrorOr<void> Generator::emit_load_from_reference(JS::ASTNode cons
         if (is<SuperExpression>(expression.object())) {
             // 1. Let env be GetThisEnvironment().
             // 2. Let actualThis be ? env.GetThisBinding().
-            // NOTE: Whilst this isn't used, it's still observable (e.g. it throws if super() hasn't been called)
+            auto this_register = allocate_register();
             emit<Bytecode::Op::ResolveThisBinding>();
+            emit<Bytecode::Op::Store>(this_register);
 
             Optional<Bytecode::Register> computed_property_value_register;
 
@@ -180,11 +181,11 @@ CodeGenerationErrorOr<void> Generator::emit_load_from_reference(JS::ASTNode cons
                 auto super_base_register = allocate_register();
                 emit<Bytecode::Op::Store>(super_base_register);
                 emit<Bytecode::Op::Load>(*computed_property_value_register);
-                emit<Bytecode::Op::GetByValue>(super_base_register);
+                emit<Bytecode::Op::GetByValueWithThis>(super_base_register, this_register);
             } else {
                 // 3. Let propertyKey be StringValue of IdentifierName.
                 auto identifier_table_ref = intern_identifier(verify_cast<Identifier>(expression.property()).string());
-                emit<Bytecode::Op::GetById>(identifier_table_ref);
+                emit<Bytecode::Op::GetByIdWithThis>(identifier_table_ref, this_register);
             }
         } else {
             TRY(expression.object().generate_bytecode(*this));
@@ -226,31 +227,76 @@ CodeGenerationErrorOr<void> Generator::emit_store_to_reference(JS::ASTNode const
         emit<Bytecode::Op::Store>(value_reg);
 
         auto& expression = static_cast<MemberExpression const&>(node);
-        TRY(expression.object().generate_bytecode(*this));
 
-        auto object_reg = allocate_register();
+        // https://tc39.es/ecma262/#sec-super-keyword-runtime-semantics-evaluation
-        emit<Bytecode::Op::Store>(object_reg);
+        if (is<SuperExpression>(expression.object())) {
+            // 1. Let env be GetThisEnvironment().
+            // 2. Let actualThis be ? env.GetThisBinding().
+            auto this_register = allocate_register();
+            emit<Bytecode::Op::ResolveThisBinding>();
+            emit<Bytecode::Op::Store>(this_register);
+
+            Optional<Bytecode::Register> computed_property_value_register;
+
+            if (expression.is_computed()) {
+                // SuperProperty : super [ Expression ]
+                // 3. Let propertyNameReference be ? Evaluation of Expression.
+                // 4. Let propertyNameValue be ? GetValue(propertyNameReference).
+                TRY(expression.property().generate_bytecode(*this));
+                computed_property_value_register = allocate_register();
+                emit<Bytecode::Op::Store>(*computed_property_value_register);
+            }
+
+            // 5/7. Return ? MakeSuperPropertyReference(actualThis, propertyKey, strict).
+
+            // https://tc39.es/ecma262/#sec-makesuperpropertyreference
+            // 1. Let env be GetThisEnvironment().
+            // 2. Assert: env.HasSuperBinding() is true.
+            // 3. Let baseValue be ? env.GetSuperBase().
+            auto super_base_register = allocate_register();
+            emit<Bytecode::Op::ResolveSuperBase>();
+            emit<Bytecode::Op::Store>(super_base_register);
 
-        if (expression.is_computed()) {
-            TRY(expression.property().generate_bytecode(*this));
-            auto property_reg = allocate_register();
-            emit<Bytecode::Op::Store>(property_reg);
             emit<Bytecode::Op::Load>(value_reg);
-            emit<Bytecode::Op::PutByValue>(object_reg, property_reg);
+
-        } else if (expression.property().is_identifier()) {
+            // 4. Return the Reference Record { [[Base]]: baseValue, [[ReferencedName]]: propertyKey, [[Strict]]: strict, [[ThisValue]]: actualThis }.
-            emit<Bytecode::Op::Load>(value_reg);
+            if (computed_property_value_register.has_value()) {
-            auto identifier_table_ref = intern_identifier(verify_cast<Identifier>(expression.property()).string());
+                // 5. Let propertyKey be ? ToPropertyKey(propertyNameValue).
-            emit<Bytecode::Op::PutById>(object_reg, identifier_table_ref);
+                // FIXME: This does ToPropertyKey out of order, which is observable by Symbol.toPrimitive!
-        } else if (expression.property().is_private_identifier()) {
+                emit<Bytecode::Op::PutByValueWithThis>(super_base_register, *computed_property_value_register, this_register);
-            emit<Bytecode::Op::Load>(value_reg);
+            } else {
-            auto identifier_table_ref = intern_identifier(verify_cast<PrivateIdentifier>(expression.property()).string());
+                // 3. Let propertyKey be StringValue of IdentifierName.
-            emit<Bytecode::Op::PutPrivateById>(object_reg, identifier_table_ref);
+                auto identifier_table_ref = intern_identifier(verify_cast<Identifier>(expression.property()).string());
+                emit<Bytecode::Op::PutByIdWithThis>(super_base_register, this_register, identifier_table_ref);
+            }
         } else {
-            return CodeGenerationError {
+            TRY(expression.object().generate_bytecode(*this));
-                &expression,
+
-                "Unimplemented non-computed member expression"sv
+            auto object_reg = allocate_register();
-            };
+            emit<Bytecode::Op::Store>(object_reg);
+
+            if (expression.is_computed()) {
+                TRY(expression.property().generate_bytecode(*this));
+                auto property_reg = allocate_register();
+                emit<Bytecode::Op::Store>(property_reg);
+                emit<Bytecode::Op::Load>(value_reg);
+                emit<Bytecode::Op::PutByValue>(object_reg, property_reg);
+            } else if (expression.property().is_identifier()) {
+                emit<Bytecode::Op::Load>(value_reg);
+                auto identifier_table_ref = intern_identifier(verify_cast<Identifier>(expression.property()).string());
+                emit<Bytecode::Op::PutById>(object_reg, identifier_table_ref);
+            } else if (expression.property().is_private_identifier()) {
+                emit<Bytecode::Op::Load>(value_reg);
+                auto identifier_table_ref = intern_identifier(verify_cast<PrivateIdentifier>(expression.property()).string());
+                emit<Bytecode::Op::PutPrivateById>(object_reg, identifier_table_ref);
+            } else {
+                return CodeGenerationError {
+                    &expression,
+                    "Unimplemented non-computed member expression"sv
+                };
+            }
         }
+
         return {};
     }
 

Userland/Libraries/LibJS/Bytecode/Instruction.h

@@ -34,7 +34,9 @@
     O(EnterObjectEnvironment)        \
     O(Exp)                           \
     O(GetById)                       \
+    O(GetByIdWithThis)               \
     O(GetByValue)                    \
+    O(GetByValueWithThis)            \
     O(GetIterator)                   \
     O(GetMethod)                     \
     O(GetNewTarget)                  \
@@ -80,7 +82,9 @@
     O(Not)                           \
     O(PushDeclarativeEnvironment)    \
     O(PutById)                       \
+    O(PutByIdWithThis)               \
     O(PutByValue)                    \
+    O(PutByValueWithThis)            \
     O(PutPrivateById)                \
     O(ResolveThisBinding)            \
     O(ResolveSuperBase)              \

Userland/Libraries/LibJS/Bytecode/Op.cpp

@@ -48,7 +48,7 @@ DeprecatedString Instruction::to_deprecated_string(Bytecode::Executable const& e
 
 namespace JS::Bytecode::Op {
 
-static ThrowCompletionOr<void> put_by_property_key(VM& vm, Value base, Value value, PropertyKey name, PropertyKind kind)
+static ThrowCompletionOr<void> put_by_property_key(VM& vm, Value base, Value this_value, Value value, PropertyKey name, PropertyKind kind)
 {
     auto object = TRY(base.to_object(vm));
     if (kind == PropertyKind::Getter || kind == PropertyKind::Setter) {
@@ -71,7 +71,7 @@ static ThrowCompletionOr<void> put_by_property_key(VM& vm, Value base, Value val
         break;
     }
     case PropertyKind::KeyValue: {
-        bool succeeded = TRY(object->internal_set(name, value, base));
+        bool succeeded = TRY(object->internal_set(name, value, this_value));
         if (!succeeded && vm.in_strict_mode())
             return vm.throw_completion<TypeError>(ErrorType::ReferenceNullishSetProperty, name, TRY_OR_THROW_OOM(vm, base.to_string_without_side_effects()));
         break;
@@ -523,12 +523,11 @@ ThrowCompletionOr<void> SetLocal::execute_impl(Bytecode::Interpreter& interprete
     return {};
 }
 
-ThrowCompletionOr<void> GetById::execute_impl(Bytecode::Interpreter& interpreter) const
+static ThrowCompletionOr<void> get_by_id(Bytecode::Interpreter& interpreter, IdentifierTableIndex property, Value base_value, Value this_value)
 {
     auto& vm = interpreter.vm();
 
-    auto const& name = interpreter.current_executable().get_identifier(m_property);
+    auto const& name = interpreter.current_executable().get_identifier(property);
-    auto base_value = interpreter.accumulator();
 
     // OPTIMIZATION: For various primitives we can avoid actually creating a new object for them.
     GCPtr<Object> base_obj;
@@ -547,10 +546,23 @@ ThrowCompletionOr<void> GetById::execute_impl(Bytecode::Interpreter& interpreter
         base_obj = TRY(base_value.to_object(vm));
     }
 
-    interpreter.accumulator() = TRY(base_obj->internal_get(name, base_value));
+    interpreter.accumulator() = TRY(base_obj->internal_get(name, this_value));
     return {};
 }
 
+ThrowCompletionOr<void> GetById::execute_impl(Bytecode::Interpreter& interpreter) const
+{
+    auto base_value = interpreter.accumulator();
+    return get_by_id(interpreter, m_property, base_value, base_value);
+}
+
+ThrowCompletionOr<void> GetByIdWithThis::execute_impl(Bytecode::Interpreter& interpreter) const
+{
+    auto base_value = interpreter.accumulator();
+    auto this_value = interpreter.reg(m_this_value);
+    return get_by_id(interpreter, m_property, base_value, this_value);
+}
+
 ThrowCompletionOr<void> GetPrivateById::execute_impl(Bytecode::Interpreter& interpreter) const
 {
     auto& vm = interpreter.vm();
@@ -582,7 +594,19 @@ ThrowCompletionOr<void> PutById::execute_impl(Bytecode::Interpreter& interpreter
     auto value = interpreter.accumulator();
     auto base = interpreter.reg(m_base);
     PropertyKey name = interpreter.current_executable().get_identifier(m_property);
-    TRY(put_by_property_key(vm, base, value, name, m_kind));
+    TRY(put_by_property_key(vm, base, base, value, name, m_kind));
+    interpreter.accumulator() = value;
+    return {};
+}
+
+ThrowCompletionOr<void> PutByIdWithThis::execute_impl(Bytecode::Interpreter& interpreter) const
+{
+    auto& vm = interpreter.vm();
+    // NOTE: Get the value from the accumulator before side effects have a chance to overwrite it.
+    auto value = interpreter.accumulator();
+    auto base = interpreter.reg(m_base);
+    PropertyKey name = interpreter.current_executable().get_identifier(m_property);
+    TRY(put_by_property_key(vm, base, interpreter.reg(m_this_value), value, name, m_kind));
     interpreter.accumulator() = value;
     return {};
 }
@@ -1042,6 +1066,21 @@ ThrowCompletionOr<void> GetByValue::execute_impl(Bytecode::Interpreter& interpre
     return {};
 }
 
+ThrowCompletionOr<void> GetByValueWithThis::execute_impl(Bytecode::Interpreter& interpreter) const
+{
+    auto& vm = interpreter.vm();
+
+    // NOTE: Get the property key from the accumulator before side effects have a chance to overwrite it.
+    auto property_key_value = interpreter.accumulator();
+
+    auto object = TRY(interpreter.reg(m_base).to_object(vm));
+
+    auto property_key = TRY(property_key_value.to_property_key(vm));
+
+    interpreter.accumulator() = TRY(object->internal_get(property_key, interpreter.reg(m_this_value)));
+    return {};
+}
+
 ThrowCompletionOr<void> PutByValue::execute_impl(Bytecode::Interpreter& interpreter) const
 {
     auto& vm = interpreter.vm();
@@ -1052,7 +1091,22 @@ ThrowCompletionOr<void> PutByValue::execute_impl(Bytecode::Interpreter& interpre
     auto base = interpreter.reg(m_base);
 
     auto property_key = TRY(interpreter.reg(m_property).to_property_key(vm));
-    TRY(put_by_property_key(vm, base, value, property_key, m_kind));
+    TRY(put_by_property_key(vm, base, base, value, property_key, m_kind));
+    interpreter.accumulator() = value;
+    return {};
+}
+
+ThrowCompletionOr<void> PutByValueWithThis::execute_impl(Bytecode::Interpreter& interpreter) const
+{
+    auto& vm = interpreter.vm();
+
+    // NOTE: Get the value from the accumulator before side effects have a chance to overwrite it.
+    auto value = interpreter.accumulator();
+
+    auto base = interpreter.reg(m_base);
+
+    auto property_key = TRY(interpreter.reg(m_property).to_property_key(vm));
+    TRY(put_by_property_key(vm, base, interpreter.reg(m_this_value), value, property_key, m_kind));
     interpreter.accumulator() = value;
     return {};
 }
@@ -1411,6 +1465,17 @@ DeprecatedString PutById::to_deprecated_string_impl(Bytecode::Executable const&
     return DeprecatedString::formatted("PutById kind:{} base:{}, property:{} ({})", kind, m_base, m_property, executable.identifier_table->get(m_property));
 }
 
+DeprecatedString PutByIdWithThis::to_deprecated_string_impl(Bytecode::Executable const& executable) const
+{
+    auto kind = m_kind == PropertyKind::Getter
+        ? "getter"
+        : m_kind == PropertyKind::Setter
+        ? "setter"
+        : "property";
+
+    return DeprecatedString::formatted("PutByIdWithThis kind:{} base:{}, property:{} ({}) this_value:{}", kind, m_base, m_property, executable.identifier_table->get(m_property), m_this_value);
+}
+
 DeprecatedString PutPrivateById::to_deprecated_string_impl(Bytecode::Executable const& executable) const
 {
     auto kind = m_kind == PropertyKind::Getter
@@ -1427,6 +1492,11 @@ DeprecatedString GetById::to_deprecated_string_impl(Bytecode::Executable const&
     return DeprecatedString::formatted("GetById {} ({})", m_property, executable.identifier_table->get(m_property));
 }
 
+DeprecatedString GetByIdWithThis::to_deprecated_string_impl(Bytecode::Executable const& executable) const
+{
+    return DeprecatedString::formatted("GetByIdWithThis {} ({}) this_value:{}", m_property, executable.identifier_table->get(m_property), m_this_value);
+}
+
 DeprecatedString GetPrivateById::to_deprecated_string_impl(Bytecode::Executable const& executable) const
 {
     return DeprecatedString::formatted("GetPrivateById {} ({})", m_property, executable.identifier_table->get(m_property));
@@ -1611,6 +1681,11 @@ DeprecatedString GetByValue::to_deprecated_string_impl(Bytecode::Executable cons
     return DeprecatedString::formatted("GetByValue base:{}", m_base);
 }
 
+DeprecatedString GetByValueWithThis::to_deprecated_string_impl(Bytecode::Executable const&) const
+{
+    return DeprecatedString::formatted("GetByValueWithThis base:{} this_value:{}", m_base, m_this_value);
+}
+
 DeprecatedString PutByValue::to_deprecated_string_impl(Bytecode::Executable const&) const
 {
     auto kind = m_kind == PropertyKind::Getter
@@ -1622,6 +1697,17 @@ DeprecatedString PutByValue::to_deprecated_string_impl(Bytecode::Executable cons
     return DeprecatedString::formatted("PutByValue kind:{} base:{}, property:{}", kind, m_base, m_property);
 }
 
+DeprecatedString PutByValueWithThis::to_deprecated_string_impl(Bytecode::Executable const&) const
+{
+    auto kind = m_kind == PropertyKind::Getter
+        ? "getter"
+        : m_kind == PropertyKind::Setter
+        ? "setter"
+        : "property";
+
+    return DeprecatedString::formatted("PutByValueWithThis kind:{} base:{}, property:{} this_value:{}", kind, m_base, m_property, m_this_value);
+}
+
 DeprecatedString DeleteByValue::to_deprecated_string_impl(Bytecode::Executable const&) const
 {
     return DeprecatedString::formatted("DeleteByValue base:{}", m_base);

Userland/Libraries/LibJS/Bytecode/Op.h

@@ -579,6 +579,29 @@ private:
     IdentifierTableIndex m_property;
 };
 
+class GetByIdWithThis final : public Instruction {
+public:
+    GetByIdWithThis(IdentifierTableIndex property, Register this_value)
+        : Instruction(Type::GetByIdWithThis)
+        , m_property(property)
+        , m_this_value(this_value)
+    {
+    }
+
+    ThrowCompletionOr<void> execute_impl(Bytecode::Interpreter&) const;
+    DeprecatedString to_deprecated_string_impl(Bytecode::Executable const&) const;
+    void replace_references_impl(BasicBlock const&, BasicBlock const&) { }
+    void replace_references_impl(Register from, Register to)
+    {
+        if (m_this_value == from)
+            m_this_value = to;
+    }
+
+private:
+    IdentifierTableIndex m_property;
+    Register m_this_value;
+};
+
 class GetPrivateById final : public Instruction {
 public:
     explicit GetPrivateById(IdentifierTableIndex property)
@@ -646,6 +669,35 @@ private:
     PropertyKind m_kind;
 };
 
+class PutByIdWithThis final : public Instruction {
+public:
+    PutByIdWithThis(Register base, Register this_value, IdentifierTableIndex property, PropertyKind kind = PropertyKind::KeyValue)
+        : Instruction(Type::PutByIdWithThis)
+        , m_base(base)
+        , m_this_value(this_value)
+        , m_property(property)
+        , m_kind(kind)
+    {
+    }
+
+    ThrowCompletionOr<void> execute_impl(Bytecode::Interpreter&) const;
+    DeprecatedString to_deprecated_string_impl(Bytecode::Executable const&) const;
+    void replace_references_impl(BasicBlock const&, BasicBlock const&) { }
+    void replace_references_impl(Register from, Register to)
+    {
+        if (m_base == from)
+            m_base = to;
+        if (m_this_value == from)
+            m_this_value = to;
+    }
+
+private:
+    Register m_base;
+    Register m_this_value;
+    IdentifierTableIndex m_property;
+    PropertyKind m_kind;
+};
+
 class PutPrivateById final : public Instruction {
 public:
     explicit PutPrivateById(Register base, IdentifierTableIndex property, PropertyKind kind = PropertyKind::KeyValue)
@@ -709,6 +761,31 @@ private:
     Register m_base;
 };
 
+class GetByValueWithThis final : public Instruction {
+public:
+    GetByValueWithThis(Register base, Register this_value)
+        : Instruction(Type::GetByValueWithThis)
+        , m_base(base)
+        , m_this_value(this_value)
+    {
+    }
+
+    ThrowCompletionOr<void> execute_impl(Bytecode::Interpreter&) const;
+    DeprecatedString to_deprecated_string_impl(Bytecode::Executable const&) const;
+    void replace_references_impl(BasicBlock const&, BasicBlock const&) { }
+    void replace_references_impl(Register from, Register to)
+    {
+        if (m_base == from)
+            m_base = to;
+        if (m_this_value == from)
+            m_this_value = to;
+    }
+
+private:
+    Register m_base;
+    Register m_this_value;
+};
+
 class PutByValue final : public Instruction {
 public:
     PutByValue(Register base, Register property, PropertyKind kind = PropertyKind::KeyValue)
@@ -726,6 +803,8 @@ public:
     {
         if (m_base == from)
             m_base = to;
+        if (m_property == from)
+            m_property = to;
     }
 
 private:
@@ -734,6 +813,37 @@ private:
     PropertyKind m_kind;
 };
 
+class PutByValueWithThis final : public Instruction {
+public:
+    PutByValueWithThis(Register base, Register property, Register this_value, PropertyKind kind = PropertyKind::KeyValue)
+        : Instruction(Type::PutByValueWithThis)
+        , m_base(base)
+        , m_property(property)
+        , m_this_value(this_value)
+        , m_kind(kind)
+    {
+    }
+
+    ThrowCompletionOr<void> execute_impl(Bytecode::Interpreter&) const;
+    DeprecatedString to_deprecated_string_impl(Bytecode::Executable const&) const;
+    void replace_references_impl(BasicBlock const&, BasicBlock const&) { }
+    void replace_references_impl(Register from, Register to)
+    {
+        if (m_base == from)
+            m_base = to;
+        if (m_property == from)
+            m_property = to;
+        if (m_this_value == from)
+            m_this_value = to;
+    }
+
+private:
+    Register m_base;
+    Register m_property;
+    Register m_this_value;
+    PropertyKind m_kind;
+};
+
 class DeleteByValue final : public Instruction {
 public:
     DeleteByValue(Register base)

Userland/Libraries/LibJS/Bytecode/Pass/LoadElimination.cpp

@@ -122,9 +122,13 @@ static NonnullOwnPtr<BasicBlock> eliminate_loads(BasicBlock const& block, size_t
             // These can trigger proxies, which call into user code
             // So these are treated like calls
         case GetByValue:
+        case GetByValueWithThis:
         case GetById:
+        case GetByIdWithThis:
         case PutByValue:
+        case PutByValueWithThis:
         case PutById:
+        case PutByIdWithThis:
             // Attribute accesses (`a.o` or `a[o]`) may result in calls to getters or setters
             // or may trigger proxies
             // So these are treated like calls