[builtins] Properly reject immediately throwing thenables.

Bug: chromium:830565
Change-Id: I1adab76e790a81f51f7b03165962992f5afecc99
Reviewed-on: https://chromium-review.googlesource.com/1023400
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52748}

src/builtins/builtins-promise-gen.cc

@@ -1110,7 +1110,7 @@ TF_BUILTIN(PromiseResolveThenableJob, PromiseBuiltinsAssembler) {
       // We need to reject the {thenable}.
       Node* const result = CallJS(
           CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
-          native_context, UndefinedConstant(), var_exception.value());
+          native_context, reject, UndefinedConstant(), var_exception.value());
       Return(result);
     }
   }

test/mjsunit/regress/regress-crbug-830565.js

@@ -0,0 +1,17 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+testAsync(assert => {
+  assert.plan(1);
+  const error = new TypeError('Throwing');
+  Promise.resolve({ then(resolve, reject) {
+    throw error;
+  }}).then(v => {
+    assert.unreachable();
+  }, e => {
+    assert.equals(error, e);
+  });
+});

test/webkit/fast/js/Promise-resolve-with-then-exception-expected.txt

@@ -3,6 +3,8 @@ Test whether Promise treats thenable correctly.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 The promise is already rejected now.
+PASS rejected
+PASS result is "hello"
 PASS successfullyParsed is true
 
 TEST COMPLETE