Do security checks in the promise constructor

src/runtime/runtime-internal.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include <memory>
 
 #include "src/arguments.h"
 #include "src/ast/prettyprinter.h"
 #include "src/bootstrapper.h"
+#include "src/builtins/builtins.h"
 #include "src/conversions.h"
 #include "src/debug/debug.h"
 #include "src/frames-inl.h"
 #include "src/isolate-inl.h"
 #include "src/messages.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
 #include "src/wasm/wasm-module.h"
 
 namespace v8 {
@@ skipping 463 matching lines @@
       isolate, Object::OrdinaryHasInstance(isolate, callable, object));
 }
 
 RUNTIME_FUNCTION(Runtime_Typeof) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
   return *Object::TypeOf(isolate, object);
 }
 
+RUNTIME_FUNCTION(Runtime_CountUsage) {

[gsathya, 2017/01/11 17:27:31]

There is IncrementUseCounter which does the same

[jochen (gone - plz use gerrit), 2017/01/11 18:09:57]

good catch, thx

+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_INT32_ARG_CHECKED(counter_id, 0);
+  isolate->CountUsage(static_cast<v8::Isolate::UseCounterFeature>(counter_id));
+  return isolate->heap()->undefined_value();
+}
+
+RUNTIME_FUNCTION(Runtime_AllowDynamicFunction) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
+  Handle<JSObject> global_proxy(target->global_proxy(), isolate);
+  return *isolate->factory()->ToBoolean(
+      Builtins::AllowDynamicFunction(isolate, target, global_proxy));
+}
+
 }  // namespace internal
 }  // namespace v8