Check that Promise subclasses have callable resolve/reject

src/js/promise.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils, extrasUtils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 199 matching lines @@
   if (GET_PRIVATE(promise, promiseStatusSymbol) == 0) {
     var debug_is_active = DEBUG_IS_ACTIVE;
     if (debug_is_active ||
         !HAS_DEFINED_PRIVATE(promise, promiseHasHandlerSymbol)) {
       %PromiseRejectEvent(promise, r, debug_is_active);
     }
   }
   PromiseDone(promise, -1, r, promiseOnRejectSymbol)
 }
 
-// Convenience.
-
 function NewPromiseCapability(C) {
   if (C === GlobalPromise) {
     // Optimized case, avoid extra closure.
     var promise = PromiseInit(new GlobalPromise(promiseRawSymbol));
     var callbacks = CreateResolvingFunctions(promise);
     return {
       promise: promise,
       resolve: callbacks.resolve,
       reject: callbacks.reject
     };
   }
 
   var result = {promise: UNDEFINED, resolve: UNDEFINED, reject: UNDEFINED };
   result.promise = new C((resolve, reject) => {
     if (!IS_UNDEFINED(result.resolve) || !IS_UNDEFINED(result.reject))
         throw MakeTypeError(kPromiseExecutorAlreadyInvoked);
     result.resolve = resolve;
     result.reject = reject;
   });
 
+  if (!IS_CALLABLE(result.resolve) || !IS_CALLABLE(result.reject))
+      throw MakeTypeError(kPromiseNonCallable);
+
   return result;
 }
 
 function PromiseDeferred() {
   %IncrementUseCounter(kPromiseDefer);
   return NewPromiseCapability(this);
 }
 
 function PromiseResolved(x) {
   %IncrementUseCounter(kPromiseAccept);
@@ skipping 219 matching lines @@
 [PromiseChain, PromiseDeferred, PromiseResolved].forEach(
     fn => %FunctionRemovePrototype(fn));
 
 utils.Export(function(to) {
   to.PromiseChain = PromiseChain;
   to.PromiseDeferred = PromiseDeferred;
   to.PromiseResolved = PromiseResolved;
 });
 
 })