Proxy [[Construct]] forwarding doesn't honor newTarget.prototype (subclassing)

[proggeramlug]

Follow-up to #3656 (PR #3875). After Proxy apply/construct trap dispatch landed, three built-ins/Proxy/construct cases remain:

• construct/trap-is-missing-target-is-proxy.js
• construct/trap-is-null-target-is-proxy.js
• construct/trap-is-undefined-target-is-proxy.js

Cause

A [[Construct]] forwarded through a trap-less proxy chain to a class / bound-constructor / builtin (Array) does not honor newTarget.prototype when allocating the instance. forward_construct constructs from the target function but ignores the threaded newTarget, so instanceof newTarget, inherited getters from class X extends …, and Array subclassing fail.

Repro

class Foo { constructor(a){ this.arg = a; } }
class Bar extends Foo { get isBar(){ return true; } }
var FooProxy = new Proxy(new Proxy(Foo, {}), { construct: null });
var bar = Reflect.construct(FooProxy, [2], Bar);
// expected: bar instanceof Bar, bar.arg === 2, bar.isBar

Scope

Honor an explicit newTarget in the forwarded [[Construct]] path: allocate the instance with newTarget.prototype and run the target constructor against it (OrdinaryCreateFromConstructor semantics), including builtin subclassing (extends Array). Orthogonal to the proxy trap machinery itself.

[andrewtdiz]

I am taking this as part of the same focused construct-semantics cut as #2768.

Intended PR scope: make forwarded [[Construct]] through trap-less proxy chains honor the explicit newTarget, including allocation via newTarget.prototype for ordinary constructor targets. This should cover the proxy-chain subclassing cases without taking the separate generator Proxy.apply issue.

[andrewtdiz]

Opened draft PR for this construct-semantics cut: #4165

Scope covered here:

• Reflect.construct now uses a Reflect-specific runtime path instead of the proxy-only helper
• argumentsList goes through array-like conversion, with target/newTarget constructor validation
• trap-less proxy [[Construct]] forwarding preserves explicit newTarget for ordinary function constructors

The generator Proxy.apply receiver-frame issue remains outside this PR.

[andrewtdiz]

PR #4165 merged on June 3, 2026 and covered this proxy-chain [[Construct]] forwarding case as part of the same construct-semantics cut as #2768.

Merged scope relevant to this issue:

• trap-less proxy construction threads the explicit newTarget
• ordinary constructor allocation uses the newTarget.prototype path
• the focused regression fixture includes the proxy-chain newTarget prototype case

This issue looks stale-open and ready for maintainer closure.

[andrewtdiz]

Taking a follow-up tail discovered by rerunning test-parity/node-suite/object/reflect-proxy-construct.ts on current main after #4165 merged.

The trap-less proxy [[Construct]] forwarding fix is merged, but the fixture still fails before it reaches the final proxy-chain assertion because Object.create((Foo as any).prototype) receives a non-object value from an ordinary function .prototype read.

Intended PR scope: restore Node-compatible ordinary function .prototype value reads and keep the proxy-chain regression passing through the existing focused fixture. Non-goals: additional proxy trap behavior or unrelated Reflect namespace polish.

[andrewtdiz]

Opened draft PR #4272 for the ordinary function .prototype value-read tail that was still blocking the reflect/proxy construct fixture: #4272