[promsies] Verify status field is a smi

R=adamk@chromium.org
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2608843002
Cr-Commit-Position: refs/heads/master@{#41997}

src/objects-debug.cc

@@ -887,6 +887,7 @@ void JSPromise::JSPromiseVerify() {
   CHECK(IsJSPromise());
   JSObjectVerify();
   Isolate* isolate = GetIsolate();
+  VerifySmiField(kStatusOffset);
   CHECK(result()->IsUndefined(isolate) || result()->IsObject());
   CHECK(deferred_promise()->IsUndefined(isolate) ||
         deferred_promise()->IsJSReceiver() ||

test/cctest/test-code-stub-assembler.cc

@@ -1832,6 +1832,7 @@ TEST(AllocateJSPromise) {
 
   Node* const context = m.Parameter(kNumParams + 2);
   Node* const promise = m.AllocateJSPromise(context);
+  m.PromiseInit(promise);
   m.Return(promise);
 
   Handle<Code> code = data.GenerateCode();
@@ -1902,6 +1903,7 @@ TEST(AllocatePromiseReactionJobInfo) {
 
   Node* const context = m.Parameter(kNumParams + 2);
   Node* const promise = m.AllocateJSPromise(context);
+  m.PromiseInit(promise);
   Node* const tasks = m.AllocateFixedArray(FAST_ELEMENTS, m.IntPtrConstant(1));
   m.StoreFixedArrayElement(tasks, 0, m.UndefinedConstant());
   Node* const deferred_promise =