[SAB] Fix crash in Atomics.wake w/ infinite count.

src/js/harmony-atomics.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
@@ skipping 105 matching lines @@
     } else {
       timeout = MaxSimple(0, timeout);
     }
   }
   return %AtomicsWait(ia, index, value, timeout);
 }
 
 function AtomicsWakeJS(ia, index, count) {
   CheckSharedInteger32TypedArray(ia);
   index = ValidateIndex(index, %_TypedArrayGetLength(ia));
-  count = MaxSimple(0, TO_INTEGER(count));
+  if (IS_UNDEFINED(count)) {
+    count = INFINITY;
+  } else {
+    count = MaxSimple(0, TO_INTEGER(count));
+  }
   return %AtomicsWake(ia, index, count);
 }
 
 // -------------------------------------------------------------------
 
 var Atomics = global.Atomics;
 
 // The Atomics global is defined by the bootstrapper.
 
 %AddNamedProperty(Atomics, toStringTagSymbol, "Atomics", READ_ONLY | DONT_ENUM);
 
 utils.InstallFunctions(Atomics, DONT_ENUM, [
   // TODO(binji): remove the rest of the (non futex) Atomics functions as they
   // become builtins.
   "compareExchange", AtomicsCompareExchangeJS,
   "add", AtomicsAddJS,
   "sub", AtomicsSubJS,
   "and", AtomicsAndJS,
   "or", AtomicsOrJS,
   "xor", AtomicsXorJS,
   "exchange", AtomicsExchangeJS,
   "isLockFree", AtomicsIsLockFreeJS,
   "wait", AtomicsWaitJS,
   "wake", AtomicsWakeJS,
 ]);
 
 })