Function.prototype.bind does not preserve the target's prototype

[d01c2]

Reproduction

Object.prototype.toString.call((function* () {}).constructor("aa").bind());

Expected

[object GeneratorFunction]. A bound function inherits from whatever its target inherits from.

V8 (15.6.20):

d8> Object.prototype.toString.call((function* () {}).constructor("aa").bind());
"[object GeneratorFunction]"

Actual (QuickJS-ng)

Every bound function gets Function.prototype, whatever the target was.

qjs > Object.prototype.toString.call((function* () {}).constructor("aa").bind());
'[object Function]'

Spec

Function.prototype.bind delegates to BoundFunctionCreate, whose first step reads the target's own prototype and installs it as the bound function's [[Prototype]]. Nothing in either operation mentions Function.prototype.

Here the target is a generator function, so the bound function should inherit from %GeneratorFunction.prototype% and carry its Symbol.toStringTag. The same holds for any target whose prototype is not Function.prototype.

Versions

• QuickJS-ng: 0.17.0
• V8: 15.6.20