[inspector] fixed crash in InternalPromiseHasUserDefinedRejectHandler

Method should be ready to symbols inside of queue_arr.

BUG=v8:6168
R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2782893003
Cr-Commit-Position: refs/heads/master@{#44254}

src/isolate.cc

@@ -1930,13 +1930,20 @@ bool InternalPromiseHasUserDefinedRejectHandler(Isolate* isolate,
   Handle<FixedArray> deferred_promise_arr =
       Handle<FixedArray>::cast(deferred_promise);
   for (int i = 0; i < deferred_promise_arr->length(); i++) {
-    Handle<JSReceiver> queue_item(JSReceiver::cast(queue_arr->get(i)));
     Handle<JSReceiver> deferred_promise_item(
         JSReceiver::cast(deferred_promise_arr->get(i)));
+    if (queue_arr->get(i)->IsSymbol()) {
+      if (InternalPromiseHasUserDefinedRejectHandler(
+              isolate, Handle<JSPromise>::cast(deferred_promise_item))) {
+        return true;
+      }
+    } else {
+      Handle<JSReceiver> queue_item(JSReceiver::cast(queue_arr->get(i)));
       if (PromiseHandlerCheck(isolate, queue_item, deferred_promise_item)) {
         return true;
       }
     }
+  }
 
   return false;
 }

test/inspector/inspector.status

@@ -3,10 +3,6 @@
 # found in the LICENSE file.
 
 [
-['mode == debug', {
-  # Issue 6168. Crash.
-  'runtime/await-promise': [SKIP],
-}],
 
 ##############################################################################
 ['variant != default', {