Synthesized constructor in ClassDefinitionEvaluation is missing [[PrivateMethods]] and [[Fields]]

[linusg]

These are only present in ECMAScript Function Objects, however in the absence of a constructor method the function object is created as a Built-in Function Object:

b. Let F be CreateBuiltinFunction(defaultConstructor, 0, className, « [[ConstructorKind]], [[SourceText]] », the current Realm Record, constructorParent).

This makes the subsequent assignments invalid:

28. Set F.[[PrivateMethods]] to instancePrivateMethods.
29. Set F.[[Fields]] to instanceFields.

It's probably sufficient to add these two to the additional internal slots list passed to CreateBuiltinFunction.

---

Additionally, InitializeInstanceElements is being invoked from within the synthesized constructor's abstract closure, passing the active function object:

vi. Perform ? InitializeInstanceElements(result, F).

The AO has its argument typed as "an ECMAScript function object" and performs the same field access, which is problematic for the same reasons.

[ljharb]

Adding the slots makes sense to me, and the AO certainly should check for the presence of the X slot before accessing it, either with an early return or with a type assertion on the parameter.