[promises] PromiseResolveThenableJob: change then to be a JSReceiver

src/factory.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/factory.h"
 
 #include "src/accessors.h"
 #include "src/allocation-site-scopes.h"
 #include "src/base/bits.h"
 #include "src/bootstrapper.h"
@@ skipping 905 matching lines @@
 
 
 Handle<Struct> Factory::NewStruct(InstanceType type) {
   CALL_HEAP_FUNCTION(
       isolate(),
       isolate()->heap()->AllocateStruct(type),
       Struct);
 }
 
 Handle<PromiseContainer> Factory::NewPromiseContainer(
-    Handle<JSReceiver> thenable, Handle<JSFunction> then,
+    Handle<JSReceiver> thenable, Handle<JSReceiver> then,
     Handle<JSFunction> resolve, Handle<JSFunction> reject,
     Handle<Object> before_debug_event, Handle<Object> after_debug_event) {
   Handle<PromiseContainer> result =
       Handle<PromiseContainer>::cast(NewStruct(PROMISE_CONTAINER_TYPE));
   result->set_thenable(*thenable);
   result->set_then(*then);
   result->set_resolve(*resolve);
   result->set_reject(*reject);
   result->set_before_debug_event(*before_debug_event);
   result->set_after_debug_event(*after_debug_event);
@@ skipping 1661 matching lines @@
     Handle<AccessorInfo> prototype =
         Accessors::FunctionPrototypeInfo(isolate(), attribs);
     AccessorConstantDescriptor d(Handle<Name>(Name::cast(prototype->name())),
                                  prototype, attribs);
     map->AppendDescriptor(&d);
   }
 }
 
 }  // namespace internal
 }  // namespace v8