This fixes the crash, but the comment claiming "ordinary `[[Construct]]` semantics" overstates what the code does: ordinary `[[Construct]]` allocates the receiver from `newTarget.prototype` *before* the body runs and binds it as `this`, whereas here the implementation runs first (via `jsMockFunctionCall`, with `callframe->thisValue()`) and the fresh object is created only afterward. So `const fn = jest.fn(function () { this.value = 42 }); new fn()` returns an empty object in Bun but `{value: 42}