Harden a few builtins

src/promise.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 "use strict";
 
 // This file relies on the fact that the following declaration has been made
 // in runtime.js:
 // var $Object = global.Object
 // var $WeakMap = global.WeakMap
@@ skipping 133 matching lines @@
       break;
   }
   return deferred.promise;
 }
 
 function PromiseCatch(onReject) {
   return this.then(UNDEFINED, onReject);
 }
 
 function PromiseEnqueue(value, tasks) {
+  BUILTIN_ASSERT(IS_ARRAY(tasks));
   %EnqueueMicrotask(function() {
     for (var i = 0; i < tasks.length; i += 2) {
       PromiseHandle(value, tasks[i], tasks[i + 1])
     }
   });
 }
 
 function PromiseHandle(value, handler, deferred) {
   try {
     %DebugPromiseHandlePrologue(
@@ skipping 130 matching lines @@
     "resolve", PromiseCast
   ]);
   InstallFunctions($Promise.prototype, DONT_ENUM, [
     "chain", PromiseChain,
     "then", PromiseThen,
     "catch", PromiseCatch
   ]);
 }
 
 SetUpPromise();