1288458 - ArraySpeciesCreate should throw TypeError from GetFunctionRealm if proxy is revoked

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[André Bargull [:anba]]

Test case:
---
var x = Proxy.revocable(function(){}, {});

var c = new Proxy(x.proxy, new Proxy({}, {
    get(t, pk, r) {
        // Should not [[Get]] Symbol.species.
        print("TRAP", pk);
    }
}));

var a = [];
a.constructor = c;
x.revoke();
a.slice(0);
---

Expected: "TRAP get" is not printed
Actual: "TRAP get" is printed

Spec:
9.4.2.3 ArraySpeciesCreate, step 6.b [https://tc39.github.io/ecma262/#sec-arrayspeciescreate]
7.3.22 GetFunctionRealm, step 4.a [https://tc39.github.io/ecma262/#sec-getfunctionrealm]