Do security checks in the promise constructor

src/runtime/runtime-internal.cc

Index: src/runtime/runtime-internal.cc
diff --git a/src/runtime/runtime-internal.cc b/src/runtime/runtime-internal.cc
index 33534a786e4e4378d0bae7c60c06669816303f5a..24ca42e90d64bf73b23b578b9537e7f81bc4cf64 100644
--- a/src/runtime/runtime-internal.cc
+++ b/src/runtime/runtime-internal.cc
@@ -9,6 +9,7 @@
 #include "src/arguments.h"
 #include "src/ast/prettyprinter.h"
 #include "src/bootstrapper.h"
+#include "src/builtins/builtins.h"
 #include "src/conversions.h"
 #include "src/debug/debug.h"
 #include "src/frames-inl.h"
@@ -492,5 +493,14 @@ RUNTIME_FUNCTION(Runtime_Typeof) {
   return *Object::TypeOf(isolate, object);
 }
 
+RUNTIME_FUNCTION(Runtime_AllowDynamicFunction) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
+  Handle<JSObject> global_proxy(target->global_proxy(), isolate);
+  return *isolate->factory()->ToBoolean(
+      Builtins::AllowDynamicFunction(isolate, target, global_proxy));
+}
+
 }  // namespace internal
 }  // namespace v8