[Atomics] Fix atomic access index validation

test/mjsunit/asm/atomics-compareexchange.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --harmony-sharedarraybuffer
 
 function Module(stdlib, foreign, heap, offset) {
   "use asm";
   var MEM8 = new stdlib.Int8Array(heap, offset);
   var MEM16 = new stdlib.Int16Array(heap, offset);
@@ skipping 68 matching lines @@
 
   var ta = new taConstr(sab, offset);
   var name = Object.prototype.toString.call(ta);
   assertEquals(0, ta[0]);
   assertEquals(0, f(0, 0, 50), name);
   assertEquals(50, ta[0]);
   // Value is not equal to 0, so compareExchange won't store 100
   assertEquals(50, f(0, 0, 100), name);
   assertEquals(50, ta[0]);
   // out of bounds
-  assertEquals(oobValue, f(-1, 0, 0), name);
-  assertEquals(oobValue, f(ta.length, 0, 0), name);
+  assertThrows(function() { f(-1, 0, 0); });
+  assertThrows(function() { f(ta.length, 0, 0); });
 }
 
 function testElement(m, offset) {
   testElementType(Int8Array, m.compareExchangei8, 0, offset);
   testElementType(Int16Array, m.compareExchangei16, 0, offset);
   testElementType(Int32Array, m.compareExchangei32, 0, offset);
   testElementType(Uint8Array, m.compareExchangeu8, 0, offset);
   testElementType(Uint16Array, m.compareExchangeu16, 0, offset);
   testElementType(Uint32Array, m.compareExchangeu32, 0, offset);
 }
 
 var offset = 0;
 var sab = new SharedArrayBuffer(16);
 var m1 = Module(this, {}, sab, offset);
 testElement(m1, offset);
 
 offset = 32;
 sab = new SharedArrayBuffer(64);
 var m2 = Module(this, {}, sab, offset);
 testElement(m2, offset);