Nit: the fallback uses `constructEmptyObject(lexicalGlobalObject)`, which always inherits from `Object.prototype` and ignores `callframe->newTarget()`. So `Reflect.construct(jest.fn(), [], SomeClass)` returns an object that is *not* `instanceof SomeClass`, whereas Jest (ordinary `[[Construct]]`) would honor `newTarget.prototype`. Not blocking — the crash fix is a strict improvement — but you could use `InternalFunction::createSubclassStructure` (as in `NapiClass.cpp` / `JSDOMFile.cpp`) to derive

nit: `spyOn({ foo: 42 }, "foo")` on a non-function property is Bun-specific — Jest throws `Cannot spy the foo property because it is not a function`. Since this file is meant to be runnable in Jest/Vitest (per the header), these two lines should be wrapped in `if (isBun) { ... }`, matching the existing `spyOn works on object` test which is guarded for the same reason.