runtime: make Reflect.construct honor newTarget, array-like args, and constructor errors

[andrewtdiz]

Summary

Reflect.construct(target, argumentsList, newTarget?) currently loses required Reflect semantics in lowering and runtime:

• the HIR node stores only target and args, so newTarget is ignored,
• a special-case fold turns known-class Reflect.construct(ClassName, [args...]) into direct new ClassName(...), also ignoring newTarget,
• generic codegen calls js_proxy_construct(target, args, undefined), even for non-proxy targets,
• argumentsList is treated like Perry's array helper input rather than Node's array-like CreateListFromArrayLike,
• constructor/non-constructor validation and proxy construct trap result validation are missing.

Node behavior

Checked with Node v25.9.0:

function Target(a) { this.a = a; }
function NewTarget() {}
NewTarget.prototype.kind = 'custom';

const obj = Reflect.construct(Target, ['x'], NewTarget);
obj.a; // 'x'
Object.getPrototypeOf(obj) === NewTarget.prototype; // true
obj.kind; // 'custom'

const arrayLikeArgs = Reflect.construct(
  function (a, b) { this.sum = a + b; },
  { 0: 2, 1: 3, length: 2 },
);
arrayLikeArgs.sum; // 5

const proxy = new Proxy(function (a) { this.a = a; }, {
  construct(target, args, newTarget) {
    return { arg: args[0], isNewTarget: newTarget === proxy };
  },
});

Reflect.construct(proxy, ['p']);
// { arg: 'p', isNewTarget: true }

const badReturn = new Proxy(function () {}, {
  construct() { return 1; },
});
Reflect.construct(badReturn, []);
// TypeError: 'construct' on proxy: trap returned non-object ('1')

Reflect.construct(1, []);                 // TypeError: 1 is not a constructor
Reflect.construct(function () {}, null);   // TypeError: CreateListFromArrayLike called on non-object
Reflect.construct(function () {}, 1);      // TypeError: CreateListFromArrayLike called on non-object
Reflect.construct(function () {}, [], 1);  // TypeError: 1 is not a constructor

Perry implementation

Lowering loses newTarget and has a direct-new shortcut:

• crates/perry-hir/src/lower/expr_call/native_module.rs:969 handles Reflect.construct.
• crates/perry-hir/src/lower/expr_call/native_module.rs:970 special-cases Reflect.construct(ClassName, [args...]) and lowers it directly to Expr::New.
• crates/perry-hir/src/lower/expr_call/native_module.rs:995 otherwise reads only target and args_arr.
• crates/perry-hir/src/lower/expr_call/native_module.rs:998 returns Expr::ReflectConstruct { target, args }; there is no newTarget field.

Generic codegen hard-codes undefined for newTarget:

• crates/perry-codegen/src/expr/proxy_reflect.rs:177 lowers Expr::ReflectConstruct.
• crates/perry-codegen/src/expr/proxy_reflect.rs:180 creates an undefined value.
• crates/perry-codegen/src/expr/proxy_reflect.rs:183 calls js_proxy_construct(target, args, undefined).

The runtime helper is proxy-specific and not a full Reflect.construct implementation:

• crates/perry-runtime/src/proxy.rs:499 implements js_proxy_construct(proxy_boxed, args_array, _new_target).
• crates/perry-runtime/src/proxy.rs:500 returns undefined when lookup(proxy_boxed) fails, so generic non-proxy Reflect.construct does not construct or throw through this path.
• crates/perry-runtime/src/proxy.rs:518 invokes a construct trap when present.
• crates/perry-runtime/src/proxy.rs:520 returns the trap result directly, without checking that the trap returned an object.
• crates/perry-runtime/src/proxy.rs:525 falls back to call_with_args_array(target, args_array), which shares the array-only / no validation behavior noted in runtime: make Reflect.apply use thisArg, array-like args, and TypeErrors #2767 for Reflect.apply.

Expected fix direction

Reflect.construct should have a real Reflect path that:

• carries optional newTarget through HIR and codegen,
• defaults newTarget to target when omitted,
• validates that target and newTarget are constructors,
• creates arguments from any array-like object and throws for non-object argumentsList,
• constructs non-proxy targets instead of routing them through the proxy-only helper,
• invokes proxy construct traps with (target, args, newTarget),
• throws when a proxy construct trap returns a non-object,
• preserves direct-known-class optimizations only when they are semantics-preserving.

Duplicate search

Searched existing issues/PRs for:

• Reflect.construct
• Reflect.construct newTarget
• Reflect.construct array-like
• proxy construct trap
• construct trap returned non-object
• PR search for Reflect.construct OR proxy construct

No existing issue covered this Reflect.construct behavior.

[andrewtdiz]

I am taking this as a focused Reflect/Proxy construct-semantics cut with #3877.

Intended PR scope: route Reflect.construct through a real construct path for non-proxy targets, preserve the optional newTarget, convert array-like argumentsList inputs, validate constructor/non-constructor cases, and make trap-less proxy construction allocate with newTarget.prototype.

Non-goals for this cut: the generator Proxy.apply receiver-frame issue in #3876 and unrelated Reflect namespace descriptor polish.

[andrewtdiz]

Opened draft PR for this construct-semantics cut: #4165

Scope covered here:

• Reflect.construct now uses a Reflect-specific runtime path instead of the proxy-only helper
• argumentsList goes through array-like conversion, with target/newTarget constructor validation
• trap-less proxy [[Construct]] forwarding preserves explicit newTarget for ordinary function constructors

The generator Proxy.apply receiver-frame issue remains outside this PR.

[andrewtdiz]

PR #4165 merged on June 3, 2026 with the focused Reflect.construct/proxy construct-semantics cut for this issue.

Merged scope:

• Reflect.construct routes through a Reflect-specific runtime path instead of the proxy-only helper
• argumentsList uses array-like conversion and validates non-object inputs
• target and explicit newTarget constructor validation are covered
• trap-less proxy construction preserves the explicit newTarget

The corresponding regression fixture is test-parity/node-suite/object/reflect-proxy-construct.ts. This issue looks stale-open and ready for maintainer closure.

[andrewtdiz]

Taking a follow-up tail discovered by rerunning test-parity/node-suite/object/reflect-proxy-construct.ts on current main after #4165 merged.

The Reflect/proxy construct forwarding work is merged, but the focused fixture still fails before the final proxy-chain assertion because an ordinary function .prototype value read is not materializing as an object for Object.create((Foo as any).prototype).

Intended PR scope: restore Node-compatible ordinary function .prototype value reads, including the constructor self-link and arrow-function undefined behavior, then rerun the reflect/proxy construct fixture. Non-goals: new Reflect/proxy semantics beyond the function-prototype value read.

[andrewtdiz]

Opened draft PR #4272 for the ordinary function .prototype value-read tail that was still blocking the reflect/proxy construct fixture: #4272