[turbofan] Fix types of Promise#catch() and Promise#finally().

We cannot assign a meaningful type to Promise#catch() or
Promise#finally(), since they both return whatever the invocation of
'then' on the receiver returns, and that is monkeypatchable by arbitrary
user JavaScript.

Bug: chromium:908309, v8:7253
Change-Id: Ib15f81c366938a1b1f10be6c6af85c1f3374b898
Reviewed-on: https://chromium-review.googlesource.com/c/1350789Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57828}

src/compiler/typer.cc

@@ -1644,10 +1644,6 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
 
     case BuiltinFunctionId::kPromiseAll:
       return Type::Receiver();
-    case BuiltinFunctionId::kPromisePrototypeCatch:
-      return Type::Receiver();
-    case BuiltinFunctionId::kPromisePrototypeFinally:
-      return Type::Receiver();
     case BuiltinFunctionId::kPromisePrototypeThen:
       return Type::Receiver();
     case BuiltinFunctionId::kPromiseRace:

test/mjsunit/regress/regress-crbug-908309.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const p = Object.defineProperty(Promise.resolve(), 'then', {
+  value() { return 0; }
+});
+
+(function() {
+  function foo() { return p.catch().catch(); }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+})();
+
+(function() {
+  function foo() { return p.finally().finally(); }
+
+  assertThrows(foo, TypeError);
+  assertThrows(foo, TypeError);
+  %OptimizeFunctionOnNextCall(foo);
+  assertThrows(foo, TypeError);
+})();