Chrome Version: 66.0.3359.26 (Official Build) dev (64-bit)

OS: OSX

What steps will reproduce the problem?  Load the attached self-describing testscase.

What is the expected result? Console logging shows 0, 1.

What happens instead?  Console logging shows 0, 2.

Per spec this should land directly in https://tc39.github.io/ecma262/#sec-reflect.construct which will then call https://tc39.github.io/ecma262/#sec-construct which will call HTMLElement.[[Construct]], which lands in https://html.spec.whatwg.org/multipage/dom.html#htmlconstructor

This then does a single .prototype get on the NewTarget in step 6.  There should be no other .prototype gets happening here.

Firefox nightly and Safari tech preview get this right, as far as I can tell.
 

Deleted: baz.html 638 bytes

baz.html 638 bytes View Download