My reading of https://tc39.es/ecma262/#sec-performpromiseany says that:

var poison = new EvalError();
var promise = new Promise(function () {});
promise.then = function () { throw poison; };
Promise.any([promise]) // should reject with an AggregateError

However, all the implementations I've tested reject with poison. Can someone either help me understand which behavior is correct, and why?