[d8] Fix OOB for unhandled rejected promises

Bug: chromium:1121111
Change-Id: I34d60957fe972066928762be961b9a963bae7975
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390148Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69782}

src/d8/d8.cc

@@ -1197,15 +1197,15 @@ size_t PerIsolateData::GetUnhandledPromiseCount() {
 int PerIsolateData::HandleUnhandledPromiseRejections() {
   v8::HandleScope scope(isolate_);
   // Ignore promises that get added during error reporting.
-  size_t unhandled_promises_count = unhandled_promises_.size();
-  for (size_t i = 0; i < unhandled_promises_count; i++) {
+  size_t i = 0;
+  for (; i < unhandled_promises_.size(); i++) {
     const auto& tuple = unhandled_promises_[i];
     Local<v8::Message> message = std::get<1>(tuple).Get(isolate_);
     Local<v8::Value> value = std::get<2>(tuple).Get(isolate_);
     Shell::ReportException(isolate_, message, value);
   }
   unhandled_promises_.clear();
-  return static_cast<int>(unhandled_promises_count);
+  return static_cast<int>(i);
 }
 
 PerIsolateData::RealmScope::RealmScope(PerIsolateData* data) : data_(data) {

test/message/mjsunit/fail/assert-in-promise-fail-recursive.out

@@ -8,5 +8,11 @@ Error: WebAssembly.compile(): Argument 0 must be a buffer source
     at console.log (<anonymous>)
     at *%(basename)s:12:9
 
-1 pending unhandled Promise rejection(s) detected.
+*%(basename)s:9: Error: WebAssembly.compile(): Argument 0 must be a buffer source
+  WebAssembly.compile();
+              ^
+Error: WebAssembly.compile(): Argument 0 must be a buffer source
+    at TypeError.name (*%(basename)s:9:15)
+    at TypeError.toString (<anonymous>)
 
+2 pending unhandled Promise rejection(s) detected.