[promises] fix deferred object leak

This patch sets `this` to be undefined when calling resolve and reject
functions attached to the deferred.

BUG=v8:5476

Review-Url: https://codereview.chromium.org/2399053003
Cr-Commit-Position: refs/heads/master@{#40056}

src/js/promise.js

@@ -172,7 +172,7 @@ function PromiseHandle(value, handler, deferred) {
     if (IS_UNDEFINED(deferred.resolve)) {
       ResolvePromise(deferred.promise, result);
     } else {
-      deferred.resolve(result);
+      %_Call(deferred.resolve, UNDEFINED, result);
     }
   } %catch (exception) {  // Natives syntax to mark this catch block.
     try {
@@ -181,7 +181,7 @@ function PromiseHandle(value, handler, deferred) {
         // redundant ExceptionEvents.
         RejectPromise(deferred.promise, exception, false);
       } else {
-        deferred.reject(exception);
+        %_Call(deferred.reject, UNDEFINED, exception);
       }
     } catch (e) { }
   } finally {
@@ -606,7 +606,7 @@ function PromiseRace(iterable) {
       }
     }
   } catch (e) {
-    deferred.reject(e)
+    %_Call(deferred.reject, UNDEFINED, e);
   }
   return deferred.promise;
 }

test/mjsunit/regress/regress-5476.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+'use strict'
+
+class LeakyPromise extends Promise {
+  constructor(executor) {
+    super((resolve, reject) => { resolve();});
+    this.resolve = function() {assertEquals(this, undefined); };
+    this.reject = function() {assertEquals(this, undefined); };
+    executor(this.resolve, this.reject);
+  }
+}
+
+const p1 = new LeakyPromise((r) => r());
+const p2 = new LeakyPromise((_, r) => r());