Don't assert on the prototype argument to Proxy::create, which is ign…

…ored.

Summary:
This assert could fire with the code in the test, which uses
a non-Object newTarget.  The assert was testing an otherwise unused
argument, so it's safe to remove.

Reviewed By: avp

Differential Revision: D23834087

fbshipit-source-id: c48647a903b7283edee86c4378745d50460f038d

include/hermes/VM/JSProxy.h

@@ -61,7 +61,9 @@ class JSProxy : public JSObject {
 
   static PseudoHandle<JSProxy> create(
       Runtime *runtime,
-      Handle<JSObject> prototype);
+      Handle<JSObject> /* prototype */) {
+    return create(runtime);
+  }
 
   static void setTargetAndHandler(
       Handle<JSObject> selfHandle,

lib/VM/JSProxy.cpp

@@ -129,15 +129,6 @@ PseudoHandle<JSProxy> JSProxy::create(Runtime *runtime) {
   return mem.initToPseudoHandle(proxy);
 }
 
-PseudoHandle<JSProxy> JSProxy::create(
-    Runtime *runtime,
-    Handle<JSObject> prototype) {
-  assert(
-      prototype.get() == runtime->objectPrototypeRawPtr &&
-      "JSProxy::create() can only be used with object prototype");
-  return create(runtime);
-}
-
 void JSProxy::setTargetAndHandler(
     Handle<JSObject> selfHandle,
     Runtime *runtime,

test/hermes/proxy.js

@@ -2141,7 +2141,10 @@ assert.equal(
 var f = function() { return 1; }
 f.a = 1;
 f.b = 2;
-checkDeep({...f})(_ => ({a:1, b:2}))
+checkDeep({...f})(_ => ({a:1, b:2}));
+
+// newTarget.prototype for Proxy ctor is !== Object.prototype does not throw
+Reflect.construct(Proxy, [{}, {}], WeakSet);
 
 // Check that defining a property in a Proxy target which is an array
 // uses fast array access (this will trip an assert otherwise)