Do security checks in the promise constructor

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 2958 matching lines @@
 
 Node* CodeStubAssembler::IsUnseededNumberDictionary(Node* object) {
   return WordEqual(LoadMap(object),
                    LoadRoot(Heap::kUnseededNumberDictionaryMapRootIndex));
 }
 
 Node* CodeStubAssembler::IsJSFunction(Node* object) {
   return HasInstanceType(object, JS_FUNCTION_TYPE);
 }
 
+Node* CodeStubAssembler::IsJSFunctionInstanceType(Node* instance_type) {

[Igor Sheludko, 2017/01/12 10:12:57]

I think it would be nice to have one helper method like
  IsInstanceType(Node* instance_type, InstanceType type)
or even
  InstanceTypeEqual(...)
instead.

And please put it below IsJSReceiverInstanceType().

+  return Word32Equal(instance_type, Int32Constant(JS_FUNCTION_TYPE));
+}
+
+Node* CodeStubAssembler::IsJSBoundFunctionInstanceType(Node* instance_type) {
+  return Word32Equal(instance_type, Int32Constant(JS_BOUND_FUNCTION_TYPE));
+}
+
 Node* CodeStubAssembler::StringCharCodeAt(Node* string, Node* index,
                                           ParameterMode parameter_mode) {
   CSA_ASSERT(this, IsString(string));
   // Translate the {index} into a Word.
   index = ParameterToWord(index, parameter_mode);
 
   // We may need to loop in case of cons or sliced strings.
   Variable var_index(this, MachineType::PointerRepresentation());
   Variable var_result(this, MachineRepresentation::kWord32);
   Variable var_string(this, MachineRepresentation::kTagged);
@@ skipping 5346 matching lines @@
   StoreObjectFieldNoWriteBarrier(result,
                                  PromiseReactionJobInfo::kDebugNameOffset,
                                  SmiConstant(kDebugNotActive));
   StoreObjectFieldNoWriteBarrier(result, PromiseReactionJobInfo::kContextOffset,
                                  context);
   return result;
 }
 
 }  // namespace internal
 }  // namespace v8