[promises] Don't allocate new array before filling up existing array

Previously we created 3 FixedArrays and then filled them up with
values. This meant that during the creation of the second and third
FixedArray, there were one and two FixedArrays respectively, without
any values in it which broke the FixedArrayVerify.

This patch fills each FixedArray with the correct values before
creating new ones.

BUG=chromium:672051

Review-Url: https://codereview.chromium.org/2554323003
Cr-Commit-Position: refs/heads/master@{#41564}

src/builtins/builtins-promise.cc

@@ -479,26 +479,25 @@ compiler::Node* InternalPerformPromiseThen(CodeStubAssembler* a,
 
       a->Bind(&if_singlecallback);
       {
-        // Create new FixedArrays to store callbacks.
+        // Create new FixedArrays to store callbacks, and migrate
+        // existing callbacks.
         Node* const deferreds =
             a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
+        a->StoreFixedArrayElement(deferreds, 0, existing_deferred);
+        a->StoreFixedArrayElement(deferreds, 1, deferred);
+
         Node* const fulfill_reactions =
             a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
-        Node* const reject_reactions =
-            a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
-
-        // Store existing callbacks in FixedArrays.
-        a->StoreFixedArrayElement(deferreds, 0, existing_deferred);
         a->StoreFixedArrayElement(
             fulfill_reactions, 0,
             a->LoadObjectField(promise, JSPromise::kFulfillReactionsOffset));
+        a->StoreFixedArrayElement(fulfill_reactions, 1, var_on_resolve.value());
+
+        Node* const reject_reactions =
+            a->AllocateFixedArray(FAST_ELEMENTS, a->Int32Constant(2));
         a->StoreFixedArrayElement(
             reject_reactions, 0,
             a->LoadObjectField(promise, JSPromise::kRejectReactionsOffset));
-
-        // Store new callbacks in FixedArrays.
-        a->StoreFixedArrayElement(deferreds, 1, deferred);
-        a->StoreFixedArrayElement(fulfill_reactions, 1, var_on_resolve.value());
         a->StoreFixedArrayElement(reject_reactions, 1, var_on_reject.value());
 
         // Store new FixedArrays in promise.