[Promise.any] Fix crash if "then" is not callble

Bug: chromium:1078825
Change-Id: I0cfa7dcef0efef8a066ee0e9a85d8d0f27343b1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187495
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67651}

src/builtins/promise-any.tq

@@ -95,6 +95,14 @@ namespace promise {
     const index = identityHash - 1;
 
     // 6. Let errors be F.[[Errors]].
+    if (context[PromiseAnyRejectElementContextSlots::
+                    kPromiseAnyRejectElementErrorsArraySlot] == Undefined) {
+      // We're going to reject the Promise with a more fundamental error (e.g.,
+      // something went wrong with iterating the Promises). We don't need to
+      // construct the "errors" array.
+      return Undefined;
+    }
+
     const errorsArray = UnsafeCast<FixedArray>(
         context[PromiseAnyRejectElementContextSlots::
                     kPromiseAnyRejectElementErrorsArraySlot]);

test/mjsunit/regress-crbug-1078825.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --harmony-promise-any
+
+load('test/mjsunit/test-async.js');
+
+(function() {
+  const p1 = Promise.reject(1);
+  const p2 = Promise.resolve(1);
+  Object.defineProperty(p2, "then", {});
+
+  testAsync(assert => {
+    assert.plan(1);
+    Promise.any([p1, p2]).then(
+      assert.unreachable,
+      (e) => { assert.equals(true, e instanceof TypeError); });
+    });
+})();