[promises] PromiseResolveThenableJob: change then to be a JSReceiver

BUG=v8:649078

Review-Url: https://codereview.chromium.org/2362503003
Cr-Commit-Position: refs/heads/master@{#39609}

src/factory.cc

@@ -923,7 +923,7 @@ Handle<Struct> Factory::NewStruct(InstanceType type) {
 }
 
 Handle<PromiseContainer> Factory::NewPromiseContainer(
-    Handle<JSReceiver> thenable, Handle<JSFunction> then,
+    Handle<JSReceiver> thenable, Handle<JSReceiver> then,
     Handle<JSFunction> resolve, Handle<JSFunction> reject,
     Handle<Object> before_debug_event, Handle<Object> after_debug_event) {
   Handle<PromiseContainer> result =

src/factory.h

@@ -62,7 +62,7 @@ class Factory final {
 
   // Create a new PromiseContainer struct.
   Handle<PromiseContainer> NewPromiseContainer(
-      Handle<JSReceiver> thenable, Handle<JSFunction> then,
+      Handle<JSReceiver> thenable, Handle<JSReceiver> then,
       Handle<JSFunction> resolve, Handle<JSFunction> reject,
       Handle<Object> before_debug_event, Handle<Object> after_debug_event);
 

src/isolate.cc

@@ -2981,7 +2981,7 @@ void Isolate::PromiseResolveThenableJob(Handle<PromiseContainer> container,
   Handle<JSReceiver> thenable(container->thenable(), this);
   Handle<JSFunction> resolve(container->resolve(), this);
   Handle<JSFunction> reject(container->reject(), this);
-  Handle<JSFunction> then(container->then(), this);
+  Handle<JSReceiver> then(container->then(), this);
   Handle<Object> argv[] = {resolve, reject};
   *result = Execution::TryCall(this, then, thenable, arraysize(argv), argv,
                                maybe_exception);
@@ -3057,10 +3057,11 @@ void Isolate::RunMicrotasksInternal() {
         callback(data);
       } else {
         SaveContext save(this);
-        Context* context =
-            microtask->IsJSFunction()
-                ? Handle<JSFunction>::cast(microtask)->context()
-                : Handle<PromiseContainer>::cast(microtask)->then()->context();
+        Context* context = microtask->IsJSFunction()
+                               ? Handle<JSFunction>::cast(microtask)->context()
+                               : Handle<PromiseContainer>::cast(microtask)
+                                     ->resolve()
+                                     ->context();
         set_context(context->native_context());
         handle_scope_implementer_->EnterMicrotaskContext(
             Handle<Context>(context, this));

src/objects-inl.h

@@ -5655,7 +5655,7 @@ ACCESSORS(AccessorInfo, data, Object, kDataOffset)
 ACCESSORS(Box, value, Object, kValueOffset)
 
 ACCESSORS(PromiseContainer, thenable, JSReceiver, kThenableOffset)
-ACCESSORS(PromiseContainer, then, JSFunction, kThenOffset)
+ACCESSORS(PromiseContainer, then, JSReceiver, kThenOffset)
 ACCESSORS(PromiseContainer, resolve, JSFunction, kResolveOffset)
 ACCESSORS(PromiseContainer, reject, JSFunction, kRejectOffset)
 ACCESSORS(PromiseContainer, before_debug_event, Object, kBeforeDebugEventOffset)

src/objects.h

@@ -6662,7 +6662,7 @@ class Struct: public HeapObject {
 class PromiseContainer : public Struct {
  public:
   DECL_ACCESSORS(thenable, JSReceiver)
-  DECL_ACCESSORS(then, JSFunction)
+  DECL_ACCESSORS(then, JSReceiver)
   DECL_ACCESSORS(resolve, JSFunction)
   DECL_ACCESSORS(reject, JSFunction)
   DECL_ACCESSORS(before_debug_event, Object)

src/runtime/runtime-internal.cc

@@ -558,7 +558,7 @@ RUNTIME_FUNCTION(Runtime_EnqueuePromiseResolveThenableJob) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 6);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, resolution, 0);
-  CONVERT_ARG_HANDLE_CHECKED(JSFunction, then, 1);
+  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, then, 1);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, resolve, 2);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, reject, 3);
   CONVERT_ARG_HANDLE_CHECKED(Object, before_debug_event, 4);

test/mjsunit/regress/regress-649078.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let p = Promise.resolve();
+Object.defineProperty(p, 'then', {
+  get: () => new Proxy(function() {}, p)
+});
+
+new Promise((r) => r(p));