Check that Promise subclasses have callable resolve/reject

src/js/promise.js

Index: src/js/promise.js
diff --git a/src/js/promise.js b/src/js/promise.js
index 8cf6a36cef6cc0b422627d2b1476abdf33cbb937..cf4774c3314c0823ffb7f2e84fecc76c1dbf0fbd 100644
--- a/src/js/promise.js
+++ b/src/js/promise.js
@@ -217,8 +217,6 @@ function PromiseReject(promise, r) {
   PromiseDone(promise, -1, r, promiseOnRejectSymbol)
 }
 
-// Convenience.
-
 function NewPromiseCapability(C) {
   if (C === GlobalPromise) {
     // Optimized case, avoid extra closure.
@@ -239,6 +237,9 @@ function NewPromiseCapability(C) {
     result.reject = reject;
   });
 
+  if (!IS_CALLABLE(result.resolve) || !IS_CALLABLE(result.reject))
+      throw MakeTypeError(kPromiseNonCallable);
+
   return result;
 }