[torque] Fix invalid iterator bug in Type Oracle

The aggregate type finalization loop in the Type Oracle can cause new
types to be added to the type list during finalization, invalidating
the iterator used in the container-iterating "for" loop. To fix this,
visit using an explicit index rather than using a iterator-based for
loop.

Change-Id: I2fb486043c946a492d972f1e942e3b5e331a1cea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2007499
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65860}

src/torque/type-oracle.cc

@@ -25,7 +25,9 @@ TypeOracle::GetBitFieldStructTypes() {
 
 // static
 void TypeOracle::FinalizeAggregateTypes() {
-  for (const std::unique_ptr<AggregateType>& p : Get().aggregate_types_) {
+  size_t current = 0;
+  while (current != Get().aggregate_types_.size()) {
+    auto& p = Get().aggregate_types_[current++];
     p->Finalize();
   }
 }