Do security checks in the promise constructor

src/code-stub-assembler.h

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CODE_STUB_ASSEMBLER_H_
 #define V8_CODE_STUB_ASSEMBLER_H_
 
 #include <functional>
 
 #include "src/compiler/code-assembler.h"
@@ skipping 661 matching lines @@
   Node* IsJSValue(Node* object);
   Node* IsJSArray(Node* object);
   Node* IsNativeContext(Node* object);
   Node* IsWeakCell(Node* object);
   Node* IsFixedDoubleArray(Node* object);
   Node* IsHashTable(Node* object);
   Node* IsDictionary(Node* object);
   Node* IsUnseededNumberDictionary(Node* object);
   Node* IsConstructorMap(Node* map);
   Node* IsJSFunction(Node* object);
+  Node* IsJSFunctionInstanceType(Node* instance_type);
+  Node* IsJSBoundFunctionInstanceType(Node* instance_type);
 
   // ElementsKind helpers:
   Node* IsFastElementsKind(Node* elements_kind);
   Node* IsHoleyFastElementsKind(Node* elements_kind);
 
   // String helpers.
   // Load a character from a String (might flatten a ConsString).
   Node* StringCharCodeAt(Node* string, Node* index,
                          ParameterMode parameter_mode = SMI_PARAMETERS);
   // Return the single character string with only {code}.
@@ skipping 577 matching lines @@
   }
 #else
 #define CSA_SLOW_ASSERT(csa, x) ((void)0)
 #endif
 
 DEFINE_OPERATORS_FOR_FLAGS(CodeStubAssembler::AllocationFlags);
 
 }  // namespace internal
 }  // namespace v8
 #endif  // V8_CODE_STUB_ASSEMBLER_H_