Reflect.construct on a TypedArray reads the buffer before newTarget's prototype

[d01c2]

Reproduction

const r = Proxy.revocable(function(){}, {});
r.revoke();
Reflect.construct(Float32Array, [new ArrayBuffer(2)], r.proxy);

Expected

The TypeError raised by reading prototype from a revoked Proxy.

V8 (15.6.20):

$ v8 -e 'const r = Proxy.revocable(function(){}, {}); r.revoke(); Reflect.construct(Float32Array, [new ArrayBuffer(2)], r.proxy);'
unnamed:1: TypeError: Cannot perform 'get' on a proxy that has been revoked

Actual (QuickJS-ng)

$ qjs -e 'const r = Proxy.revocable(function(){}, {}); r.revoke(); Reflect.construct(Float32Array, [new ArrayBuffer(2)], r.proxy);'
RangeError: invalid length

Spec

The TypedArray constructor calls AllocateTypedArray before it looks at its first argument, and the first step of AllocateTypedArray is GetPrototypeFromConstructor, which reads Get(ctor, "prototype"). On a revoked Proxy that read throws, so nothing about the buffer or the length is ever computed.

Dropping the buffer argument makes QuickJS take the correct path, which localises the defect to the buffer branch:

$ qjs -e 'const r = Proxy.revocable(function(){}, {}); r.revoke(); Reflect.construct(Float32Array, [], r.proxy);'
TypeError: revoked proxy

JavaScriptCore, SpiderMonkey, GraalJS and V8 all raise a revoked-Proxy TypeError with the buffer argument present.

Versions

• QuickJS-ng: 0.17.0
• V8: 15.6.20