According the spec, if Symbol.species is set, the return value of constructor should be the value of Symbol.species. It seems rhino doesn't do this.

Test case:

            var emptyFunc=function() {};
            var p = Promise.resolve(1);
            p.constructor = {};
            var pt1=p.then(emptyFunc);
            console.log('pt1='+pt1);
            var t = function(e) {
                e(emptyFunc, emptyFunc);
            };
            p.constructor[Symbol.species] = t;
            var pt2=p.then(emptyFunc);
            console.log('pt2='+pt2);
            console.log(pt2 instanceof t);

In htmlunit the output is:

pt1=[object Promise]
pt2=[object Promise]
false

In real browser such as chrome, the output is:

pt1=[object Promise]
pt2=[object Object]
true