[SAB] Fix crash in Atomics.wake w/ infinite count.

src/js/harmony-atomics.js

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 "use strict";
 
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------
 // Imports
 
 var GlobalObject = global.Object;
 var MaxSimple;
+var MinSimple;
 var toStringTagSymbol = utils.ImportNow("to_string_tag_symbol");
 
 utils.Import(function(from) {
   MaxSimple = from.MaxSimple;
+  MinSimple = from.MinSimple;
 });
 
 // -------------------------------------------------------------------
 
 
 function CheckSharedIntegerTypedArray(ia) {
   if (!%IsSharedIntegerTypedArray(ia)) {
     throw %make_type_error(kNotIntegerSharedTypedArray, ia);
   }
 }
@@ skipping 86 matching lines @@
     } else {
       timeout = MaxSimple(0, timeout);
     }
   }
   return %AtomicsWait(ia, index, value, timeout);
 }
 
 function AtomicsWakeJS(ia, index, count) {
   CheckSharedInteger32TypedArray(ia);
   index = ValidateIndex(index, %_TypedArrayGetLength(ia));
-  count = MaxSimple(0, TO_INTEGER(count));
+  if (IS_UNDEFINED(count)) {
+    count = kMaxUint32;
+  } else {
+    // Clamp to [0, kMaxUint32].
+    count = MinSimple(MaxSimple(0, TO_INTEGER(count)), kMaxUint32);
+  }
   return %AtomicsWake(ia, index, count);
 }
 
 // -------------------------------------------------------------------
 
 var Atomics = global.Atomics;
 
 // The Atomics global is defined by the bootstrapper.
 
 %AddNamedProperty(Atomics, toStringTagSymbol, "Atomics", READ_ONLY | DONT_ENUM);
 
 utils.InstallFunctions(Atomics, DONT_ENUM, [
   // TODO(binji): remove the rest of the (non futex) Atomics functions as they
   // become builtins.
   "compareExchange", AtomicsCompareExchangeJS,
   "add", AtomicsAddJS,
   "sub", AtomicsSubJS,
   "and", AtomicsAndJS,
   "or", AtomicsOrJS,
   "xor", AtomicsXorJS,
   "exchange", AtomicsExchangeJS,
   "isLockFree", AtomicsIsLockFreeJS,
   "wait", AtomicsWaitJS,
   "wake", AtomicsWakeJS,
 ]);
 
 })