Wrong argument count when calling a custom species constructor for `autoLengthTypedArray.subarray(start)`

[gibson042]

(as seen at tc39/test262#4921 (comment) )

When ta is a dynamic-length TypedArray over a resizable ArrayBuffer and ta.constructor has a newable Symbol.species, ta.subarray(start) (note: this differs from ta.subarray(start, end)) should invoke that constructor with two arguments per ECMA-262 %TypedArray%.prototype.subarray. But QuickJS incorrectly adds a third number argument.

const buf = new ArrayBuffer(8, { maxByteLength: 8 });
const ta = new Uint8Array(buf);
ta.constructor = {
  [Symbol.species]: function(...args) {
    console.log(JSON.stringify(args.map(x => typeof x)));
    return ta;
  }
};
ta.subarray(0);

--- actual
+++ expected
-["object","number","number"]
+["object","number"]