[promises] Add Torque checks to guard against a bug we had

Bug: chromium:1105318
Change-Id: I105fc4cfc1b781dc0a481c7bee9faee1923f474f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343071
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69299}

src/builtins/promise-all-element-closure.tq

@@ -159,6 +159,8 @@ transitioning macro PromiseAllResolveElementClosure<F: type>(
   values.objects[index] = updatedValue;
 
   remainingElementsCount = remainingElementsCount - 1;
+  check(remainingElementsCount >= 0);
+
   *ContextSlot(
       promiseContext,
       PromiseAllResolveElementContextSlots::

src/builtins/promise-all.tq

@@ -276,6 +276,8 @@ Reject(Object) {
       PromiseAllResolveElementContextSlots::
           kPromiseAllResolveElementRemainingSlot);
 
+  check(remainingElementsCount >= 0);
+
   if (remainingElementsCount > 0) {
     // Pre-allocate the backing store for the {values} to the desired
     // capacity. We may already have elements in "values" - this happens
@@ -295,7 +297,6 @@ Reject(Object) {
     }
   } else
     deferred {
-      assert(remainingElementsCount == 0);
       // If remainingElementsCount.[[Value]] is 0, then
       //     Let valuesArray be CreateArrayFromList(values).
       //     Perform ? Call(resultCapability.[[Resolve]], undefined,

tools/v8heapconst.py

@@ -444,27 +444,27 @@ KNOWN_OBJECTS = {
   ("old_space", 0x02a69): "StringSplitCache",
   ("old_space", 0x02e71): "RegExpMultipleCache",
   ("old_space", 0x03279): "BuiltinsConstantsTable",
-  ("old_space", 0x03625): "AsyncFunctionAwaitRejectSharedFun",
-  ("old_space", 0x0364d): "AsyncFunctionAwaitResolveSharedFun",
-  ("old_space", 0x03675): "AsyncGeneratorAwaitRejectSharedFun",
-  ("old_space", 0x0369d): "AsyncGeneratorAwaitResolveSharedFun",
-  ("old_space", 0x036c5): "AsyncGeneratorYieldResolveSharedFun",
-  ("old_space", 0x036ed): "AsyncGeneratorReturnResolveSharedFun",
-  ("old_space", 0x03715): "AsyncGeneratorReturnClosedRejectSharedFun",
-  ("old_space", 0x0373d): "AsyncGeneratorReturnClosedResolveSharedFun",
-  ("old_space", 0x03765): "AsyncIteratorValueUnwrapSharedFun",
-  ("old_space", 0x0378d): "PromiseAllResolveElementSharedFun",
-  ("old_space", 0x037b5): "PromiseAllSettledResolveElementSharedFun",
-  ("old_space", 0x037dd): "PromiseAllSettledRejectElementSharedFun",
-  ("old_space", 0x03805): "PromiseAnyRejectElementSharedFun",
-  ("old_space", 0x0382d): "PromiseCapabilityDefaultRejectSharedFun",
-  ("old_space", 0x03855): "PromiseCapabilityDefaultResolveSharedFun",
-  ("old_space", 0x0387d): "PromiseCatchFinallySharedFun",
-  ("old_space", 0x038a5): "PromiseGetCapabilitiesExecutorSharedFun",
-  ("old_space", 0x038cd): "PromiseThenFinallySharedFun",
-  ("old_space", 0x038f5): "PromiseThrowerFinallySharedFun",
-  ("old_space", 0x0391d): "PromiseValueThunkFinallySharedFun",
-  ("old_space", 0x03945): "ProxyRevokeSharedFun",
+  ("old_space", 0x0362d): "AsyncFunctionAwaitRejectSharedFun",
+  ("old_space", 0x03655): "AsyncFunctionAwaitResolveSharedFun",
+  ("old_space", 0x0367d): "AsyncGeneratorAwaitRejectSharedFun",
+  ("old_space", 0x036a5): "AsyncGeneratorAwaitResolveSharedFun",
+  ("old_space", 0x036cd): "AsyncGeneratorYieldResolveSharedFun",
+  ("old_space", 0x036f5): "AsyncGeneratorReturnResolveSharedFun",
+  ("old_space", 0x0371d): "AsyncGeneratorReturnClosedRejectSharedFun",
+  ("old_space", 0x03745): "AsyncGeneratorReturnClosedResolveSharedFun",
+  ("old_space", 0x0376d): "AsyncIteratorValueUnwrapSharedFun",
+  ("old_space", 0x03795): "PromiseAllResolveElementSharedFun",
+  ("old_space", 0x037bd): "PromiseAllSettledResolveElementSharedFun",
+  ("old_space", 0x037e5): "PromiseAllSettledRejectElementSharedFun",
+  ("old_space", 0x0380d): "PromiseAnyRejectElementSharedFun",
+  ("old_space", 0x03835): "PromiseCapabilityDefaultRejectSharedFun",
+  ("old_space", 0x0385d): "PromiseCapabilityDefaultResolveSharedFun",
+  ("old_space", 0x03885): "PromiseCatchFinallySharedFun",
+  ("old_space", 0x038ad): "PromiseGetCapabilitiesExecutorSharedFun",
+  ("old_space", 0x038d5): "PromiseThenFinallySharedFun",
+  ("old_space", 0x038fd): "PromiseThrowerFinallySharedFun",
+  ("old_space", 0x03925): "PromiseValueThunkFinallySharedFun",
+  ("old_space", 0x0394d): "ProxyRevokeSharedFun",
 }
 
 # Lower 32 bits of first page addresses for various heap spaces.