Bug 318399 – PromiseResolveThenableJob should reject the promise when SpeciesConstructor throws

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Alistair]

Resolving a promise with a Promise whose own `constructor` has a Symbol.species getter
that throws leaves the outer promise pending forever, and the exception escapes the
microtask to the host.

    const speciesError = new Error("species-boom");
    const inner = Promise.resolve();
    inner.constructor = { get [Symbol.species]() { throw speciesError; } };

    new Promise(resolve => resolve(inner)).then(
        () => print("fulfilled"),
        (e) => print("rejected: " + (e === speciesError)));
    drainMicrotasks();

Expected: the outer
promise is rejected with speciesError, printing "rejected: true".

Actual in JSC: neither callback runs, and the outer promise never settles. In an embedder
that reports unhandled microtask exceptions, the throw surfaces as an uncaught exception
with no associated promise.

Root cause: the resolution value has a fast, non-observable `then` but an invalidated
species watchpoint (it has an own `constructor` property), so the thenable job runs
promiseResolveThenableJobFastSlow (JSMicrotask.cpp), which inlines
%Promise.prototype.then%. It calls promiseSpeciesConstructor before creating the
resolving functions and returns on exception, so there is no [[Reject]] to call and the
exception is left pending. Same defect in
promiseResolveThenableJobWithInternalMicrotaskFastSlow, reached via `await`.

This regressed in bug 300130 ("[JSC] Move most of Promise operations to C++"): the
previous builtins/PromiseOperations.js implementation invoked `then` inside a try block.

[Radar WebKit Bug Importer]

<rdar://problem/181767432>

[EWS]

Committed 316937@main (707b16ac07ea): <https://commits.webkit.org/316937@main>

Reviewed commits have been landed. Closing PR #68749 and removing active labels.

[EWS]

Committed 316606.294@safari-7625-branch (1d38d3354017): <https://commits.webkit.org/316606.294@safari-7625-branch>

Reviewed commits have been landed. Closing PR #6192 and removing active labels.