Partial rollback of Promise error checking

As V8 becomes more and more spec-compliant, Promise polyfill libraries
like core.js expect fully correct. However, our Promises do not yet
support Symbol.species. Therefore, a case like

```
var test = new Promise(function(){});
test.constructor = function(){};
Promise.resolve(test)
```

would lead to an unhandled Promise rejection, whereas it should not
because test.constructor[Symbol.species] is undefined, so test.then
should end up constructing %Promise% as a fallback, rather than
calling test.constructor as if it were a constructor, which leads
this error checking code to throw.

For now, this patch removes the error checking code (which was not
present until recently). In an interactive test using core.js, the
error message on the console goes away with this patch. When @@species
support is in place, this patch can be reverted. A regression test
is added which checks for the same thing.

Partially reverted patch was originally out for review at
https://codereview.chromium.org/1531073004

BUG=v8:4633
LOG=Y
R=adamk,caitp88@gmail.com

Review URL: https://codereview.chromium.org/1578893002

Cr-Commit-Position: refs/heads/master@{#33217}

src/js/promise.js

@@ -237,11 +237,6 @@ function NewPromiseCapability(C) {
     result.reject = reject;
   });
 
-  if (!IS_CALLABLE(result.resolve))
-      throw MakeTypeError(kCalledNonCallable, "promiseCapability.[[Resolve]]");
-  if (!IS_CALLABLE(result.reject))
-      throw MakeTypeError(kCalledNonCallable, "promiseCapability.[[Reject]]");
-
   return result;
 }
 

test/mjsunit/mjsunit.status

@@ -54,7 +54,6 @@
   'es6/debug-promises/reject-with-throw-in-reject': [FAIL],
   'es6/debug-promises/reject-with-undefined-reject': [FAIL],
   'es6/debug-promises/reject-with-invalid-reject': [FAIL],
-  'es6/debug-promises/throw-with-undefined-reject': [FAIL],
 
   # Issue 4093: This test will be updated in the course of implementing
   # @@species, when TypedArray support is added.

test/mjsunit/regress/regress-crbug-575314.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// https://code.google.com/p/chromium/issues/detail?id=575314
+
+// Overwriting the constructor of a Promise with something that doesn't have
+// @@species shouldn't result in a rejection, even if that constructor
+// is somewhat bogus.
+
+var test = new Promise(function(){});
+test.constructor = function(){};
+Promise.resolve(test).catch(e => %AbortJS(e + " FAILED!"));

test/test262/test262.status

@@ -408,6 +408,12 @@
   'built-ins/Promise/resolve-function-name': [FAIL],
   'built-ins/Promise/all/resolve-element-function-name': [FAIL],
   'built-ins/Promise/executor-function-name': [FAIL],
+  'built-ins/Promise/all/capability-executor-not-callable': [FAIL],
+  'built-ins/Promise/reject/capability-executor-not-callable': [FAIL],
+  'built-ins/Promise/race/capability-executor-not-callable': [FAIL],
+  'built-ins/Promise/prototype/then/capability-executor-not-callable': [FAIL],
+  'built-ins/Promise/resolve/capability-executor-not-callable': [FAIL],
+  'built-ins/Promise/race/S25.4.4.3_A3.1_T2': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=4634
   'built-ins/DataView/prototype/setFloat64/index-check-before-value-conversion': [FAIL],
@@ -636,6 +642,7 @@
   'built-ins/Promise/race/ctx-ctor': [SKIP],
   'built-ins/Promise/reject/ctx-ctor': [SKIP],
   'built-ins/Promise/resolve/ctx-ctor': [SKIP],
+  'built-ins/Promise/reject/S25.4.4.4_A3.1_T1': [SKIP],
   'built-ins/String/prototype/codePointAt/this-is-undefined-throws': [SKIP],
   'built-ins/String/prototype/concat/S15.5.4.6_A2': [SKIP],
   'built-ins/String/prototype/endsWith/this-is-undefined-throws': [SKIP],