Fix Object constructor behavior when new target is provided (#6341)

Authored-by: Kevin Smith @zenparsing

Author: zenparsing

lib/Runtime/Library/JavascriptObject.cpp

@@ -9,25 +9,32 @@ using namespace Js;
 Var JavascriptObject::NewInstance(RecyclableObject* function, CallInfo callInfo, ...)
 {
     PROBE_STACK(function->GetScriptContext(), Js::Constants::MinStackDefault);
-
     ARGUMENTS(args, callInfo);
     ScriptContext* scriptContext = function->GetScriptContext();
+    JavascriptLibrary* library = scriptContext->GetLibrary();
 
     AssertMsg(args.HasArg(), "Should always have implicit 'this'");
 
-    // SkipDefaultNewObject function flag should have prevented the default object from
-    // being created, except when call true a host dispatch.
     Var newTarget = args.GetNewTarget();
-    bool isCtorSuperCall = JavascriptOperators::GetAndAssertIsConstructorSuperCall(args);
+    if (JavascriptOperators::GetAndAssertIsConstructorSuperCall(args) &&
+        newTarget != function)
+    {
+        return JavascriptOperators::OrdinaryCreateFromConstructor(
+            VarTo<RecyclableObject>(newTarget),
+            library->CreateObject(true),
+            nullptr,
+            scriptContext);
+    }
 
-    if (args.Info.Count > 1)
+    Var arg = args.Info.Count > 1 ? args[1] : library->GetUndefined();
+    switch (JavascriptOperators::GetTypeId(arg))
     {
-        switch (JavascriptOperators::GetTypeId(args[1]))
-        {
         case TypeIds_Undefined:
         case TypeIds_Null:
-            // Break to return a new object
-            break;
+            // Null and undefined result in a new object
+            return (callInfo.Flags & CallFlags_NotUsed)
+                ? arg
+                : library->CreateObject(true);
 
         case TypeIds_StringObject:
         case TypeIds_Function:
@@ -43,32 +50,14 @@ Var JavascriptObject::NewInstance(RecyclableObject* function, CallInfo callInfo,
         case TypeIds_Arguments:
         case TypeIds_ActivationObject:
         case TypeIds_SymbolObject:
-            return isCtorSuperCall ?
-                JavascriptOperators::OrdinaryCreateFromConstructor(VarTo<RecyclableObject>(newTarget), VarTo<RecyclableObject>(args[1]), nullptr, scriptContext) :
-                args[1];
-
-        default:
-            RecyclableObject* result = nullptr;
-            if (FALSE == JavascriptConversion::ToObject(args[1], scriptContext, &result))
-            {
-                // JavascriptConversion::ToObject should only return FALSE for null and undefined.
-                Assert(false);
-            }
-
-            return isCtorSuperCall ?
-                JavascriptOperators::OrdinaryCreateFromConstructor(VarTo<RecyclableObject>(newTarget), result, nullptr, scriptContext) :
-                result;
-        }
+            // Since we know this is an object, we can skip ToObject
+            return arg;
     }
 
-    if (callInfo.Flags & CallFlags_NotUsed)
-    {
-        return args[0];
-    }
-    Var newObj = scriptContext->GetLibrary()->CreateObject(true);
-    return isCtorSuperCall ?
-        JavascriptOperators::OrdinaryCreateFromConstructor(VarTo<RecyclableObject>(newTarget), VarTo<RecyclableObject>(newObj), nullptr, scriptContext) :
-        newObj;
+    RecyclableObject* result = nullptr;
+    JavascriptConversion::ToObject(arg, scriptContext, &result);
+    Assert(result);
+    return result;
 }
 
 Var JavascriptObject::EntryHasOwnProperty(RecyclableObject* function, CallInfo callInfo, ...)

test/es6/reflectConstructConsumeNewTarget.js

@@ -41,6 +41,30 @@ var tests = [
 
         assert.throws(function () { Reflect.construct(myDerivedClass, [], undefined ) }, TypeError, "undefined is not a constructor", "'newTarget' is not a constructor");
      }
+  },
+  {
+    name: "Reflect.construct should work with Object constructor",
+    body: function () {
+        var p = {};
+        var a = { __proto__: p };
+
+        new class extends Object {
+          constructor() {
+            super(a);
+            assert.isTrue(a.__proto__ === p);
+          }
+        };
+
+        Reflect.construct(Object, [a]);
+        assert.isTrue(a.__proto__ === p);
+
+        var q = {};
+        function C() {}
+        C.prototype = q;
+        var obj = Reflect.construct(Object, [a], C);
+        assert.isTrue(obj.__proto__ === q);
+        assert.isTrue(a.__proto__ === p);
+    }
   }
 ];