Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4945843700629504

Fuzzer: mbarbella_js_mutation
Job Type: windows_asan_d8
Platform Id: windows

Crash Type: CHECK failure
Crash Address: 
Crash State:
  args[1]->IsJSFunction() in runtime-internal.cc
  V8_Fatal
  v8::internal::Runtime_EnqueuePromiseResolveThenableJob
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=windows_asan_d8&range=419839:420163

Minimized Testcase (0.13 Kb):
Download: https://cluster-fuzz.appspot.com/download/AMIfv95vbrPTegEROaPVdGbXqjflnY9CEpF94Ef4qDFcAu1Lbdaf_S_QwNLbnimOymhw08dy30h47rqtCcVrgq4aUpoUvORnLrqZvarFkpCLZiz8ilt8XJljebmowJKbkMbCd4qFx7x1-ciVvD57TmsTFGwao-eWiw?testcase_id=4945843700629504
let p = Promise.resolve();
Object.defineProperty(p, 'then', {
  get: () => new Proxy(function() {}, p)
});
new Promise((r) => r(p));


Issue manually filed by: mstarzinger

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.