[promises] fix deferred object leak

test/mjsunit/regress/regress-5476.js

Index: test/mjsunit/regress/regress-5476.js
diff --git a/test/mjsunit/regress/regress-5476.js b/test/mjsunit/regress/regress-5476.js
new file mode 100644
index 0000000000000000000000000000000000000000..5d18cebf7a4700b862e4548a9177ceffe45c8f11
--- /dev/null
+++ b/test/mjsunit/regress/regress-5476.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+'use strict'
+
+class LeakyPromise extends Promise {
+  constructor(executor) {
+    super((resolve, reject) => { resolve();});
+    this.resolve = function() {assertEquals(this, undefined); };
+    this.reject = function() {assertEquals(this, undefined); };
+    executor(this.resolve, this.reject);
+  }
+}
+
+const p1 = new LeakyPromise((r) => r());
+const p2 = new LeakyPromise((_, r) => r());