[SAB] Fix crash in Atomics.wake w/ infinite count.

src/futex-emulation.h

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_FUTEX_EMULATION_H_
 #define V8_FUTEX_EMULATION_H_
 
 #include <stdint.h>
 
 #include "src/allocation.h"
@@ skipping 64 matching lines @@
 
   FutexWaitListNode* head_;
   FutexWaitListNode* tail_;
 
   DISALLOW_COPY_AND_ASSIGN(FutexWaitList);
 };
 
 
 class FutexEmulation : public AllStatic {
  public:
+  // Pass to Wake() to wake all waiters.
+  static const uint32_t kWakeAll = UINT32_MAX;
+
   // Check that array_buffer[addr] == value, and return "not-equal" if not. If
   // they are equal, block execution on |isolate|'s thread until woken via
   // |Wake|, or when the time given in |rel_timeout_ms| elapses. Note that
   // |rel_timeout_ms| can be Infinity.
   // If woken, return "ok", otherwise return "timed-out". The initial check and
   // the decision to wait happen atomically.
   static Object* Wait(Isolate* isolate, Handle<JSArrayBuffer> array_buffer,
                       size_t addr, int32_t value, double rel_timeout_ms);
 
   // Wake |num_waiters_to_wake| threads that are waiting on the given |addr|.
-  // The rest of the waiters will continue to wait. The return value is the
-  // number of woken waiters.
+  // |num_waiters_to_wake| can be kWakeAll, in which case all waiters are
+  // woken. The rest of the waiters will continue to wait. The return value is
+  // the number of woken waiters.
   static Object* Wake(Isolate* isolate, Handle<JSArrayBuffer> array_buffer,
-                      size_t addr, int num_waiters_to_wake);
+                      size_t addr, uint32_t num_waiters_to_wake);
 
   // Return the number of threads waiting on |addr|. Should only be used for
   // testing.
   static Object* NumWaitersForTesting(Isolate* isolate,
                                       Handle<JSArrayBuffer> array_buffer,
                                       size_t addr);
 
  private:
   friend class FutexWaitListNode;
 
   static base::LazyMutex mutex_;
   static base::LazyInstance<FutexWaitList>::type wait_list_;
 };
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_FUTEX_EMULATION_H_