[SAB] Fix crash in Atomics.wake w/ infinite count.

src/futex-emulation.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/futex-emulation.h"
 
 #include <limits>
 
 #include "src/base/macros.h"
 #include "src/base/platform/time.h"
@@ skipping 170 matching lines @@
 
     // Spurious wakeup, interrupt or timeout.
   }
 
   wait_list_.Pointer()->RemoveNode(node);
   node->waiting_ = false;
 
   return result;
 }
 
-
 Object* FutexEmulation::Wake(Isolate* isolate,
                              Handle<JSArrayBuffer> array_buffer, size_t addr,
-                             int num_waiters_to_wake) {
+                             uint32_t num_waiters_to_wake) {
   DCHECK(addr < NumberToSize(array_buffer->byte_length()));
 
   int waiters_woken = 0;
   void* backing_store = array_buffer->backing_store();
 
   base::LockGuard<base::Mutex> lock_guard(mutex_.Pointer());
   FutexWaitListNode* node = wait_list_.Pointer()->head_;
   while (node && num_waiters_to_wake > 0) {
     if (backing_store == node->backing_store_ && addr == node->wait_addr_) {
       node->waiting_ = false;
       node->cond_.NotifyOne();
-      --num_waiters_to_wake;
+      if (num_waiters_to_wake != kWakeAll) {
+        --num_waiters_to_wake;
+      }
       waiters_woken++;
     }
 
     node = node->next_;
   }
 
   return Smi::FromInt(waiters_woken);
 }
 
 
@@ skipping 14 matching lines @@
     }
 
     node = node->next_;
   }
 
   return Smi::FromInt(waiters);
 }
 
 }  // namespace internal
 }  // namespace v8