[promises] PromiseResolveThenableJob: change then to be a JSReceiver

test/mjsunit/regress/regress-649078.js

Index: test/mjsunit/regress/regress-649078.js
diff --git a/test/message/generators-throw1.js b/test/mjsunit/regress/regress-649078.js
similarity index 55%
copy from test/message/generators-throw1.js
copy to test/mjsunit/regress/regress-649078.js
index b4d404a1bf4d1e8f46c669c79f9ececd6f1ee64f..f4f6e1b1361250e99c1f63731345ca06e40eb9f1 100644
--- a/test/message/generators-throw1.js
+++ b/test/mjsunit/regress/regress-649078.js
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function* f() { yield }
+let p = Promise.resolve();
+Object.defineProperty(p, 'then', {
+  get: () => new Proxy(function() {}, p)
+});
 
-f().throw(42);
+new Promise((r) => r(p));