[bigint] Fix Object::VerifyApiCallResultType

Add BigInt to the list of allowed result types.

Bug: v8:6791, chromium:819871
Change-Id: Ib636859da07b38c462ce7017d720e5370ba618d6
Reviewed-on: https://chromium-review.googlesource.com/957422Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51859}

src/objects-inl.h

@@ -1661,8 +1661,8 @@ void Object::VerifyApiCallResultType() {
   DCHECK(IsHeapObject());
   Isolate* isolate = HeapObject::cast(this)->GetIsolate();
   if (!(IsString() || IsSymbol() || IsJSReceiver() || IsHeapNumber() ||
-        IsUndefined(isolate) || IsTrue(isolate) || IsFalse(isolate) ||
-        IsNull(isolate))) {
+        IsBigInt() || IsUndefined(isolate) || IsTrue(isolate) ||
+        IsFalse(isolate) || IsNull(isolate))) {
     FATAL("API call returned invalid object");
   }
 #endif  // DEBUG

test/mjsunit/harmony/bigint/regressions.js

@@ -33,3 +33,9 @@ var max64 = kMaxInt - 64n - 2n;
 var max32 = kMaxInt - 32n - 2n;
 // Platform independence trick: at least one of the two operations will throw!
 assertThrows(() => { var a = 2n ** max32; var b = 2n ** max64; }, RangeError);
+
+(function() {
+  function Constructor() { }
+  Constructor.prototype = 5n;
+  assertThrows(() => ({}) instanceof Constructor, TypeError);
+})();