[SAB] Validate index before value conversion

src/builtins/builtins-sharedarraybuffer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/base/macros.h"
 #include "src/base/platform/mutex.h"
 #include "src/base/platform/time.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
@@ skipping 45 matching lines @@
                               : MessageTemplate::kNotIntegerSharedTypedArray,
                    object),
       JSTypedArray);
 }
 
 // ES #sec-validateatomicaccess
 // ValidateAtomicAccess( typedArray, requestIndex )
 MUST_USE_RESULT Maybe<size_t> ValidateAtomicAccess(
     Isolate* isolate, Handle<JSTypedArray> typed_array,
     Handle<Object> request_index) {
-  // TOOD(v8:5961): Use ToIndex for indexes
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, request_index,
-                                   Object::ToNumber(request_index),
-                                   Nothing<size_t>());
-  Handle<Object> offset;
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, offset,
-                                   Object::ToInteger(isolate, request_index),
-                                   Nothing<size_t>());
-  if (!request_index->SameValue(*offset)) {
+  Handle<Object> access_index_obj;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, access_index_obj,
+      Object::ToIndex(isolate, request_index,
+                      MessageTemplate::kInvalidAtomicAccessIndex),
+      Nothing<size_t>());
+
+  size_t access_index = NumberToSize(*access_index_obj);
+  if (access_index >= typed_array->length_value()) {
     isolate->Throw(*isolate->factory()->NewRangeError(
         MessageTemplate::kInvalidAtomicAccessIndex));
     return Nothing<size_t>();
-  }
-  size_t access_index;
-  uint32_t length = typed_array->length_value();
-  if (!TryNumberToSize(*request_index, &access_index) ||
-      access_index >= length) {
-    isolate->Throw(*isolate->factory()->NewRangeError(
-        MessageTemplate::kInvalidAtomicAccessIndex));
-    return Nothing<size_t>();
   }
   return Just<size_t>(access_index);
 }
 
 // ES #sec-atomics.wake
 // Atomics.wake( typedArray, index, count )
 BUILTIN(AtomicsWake) {
   HandleScope scope(isolate);
   Handle<Object> array = args.atOrUndefined(isolate, 1);
   Handle<Object> index = args.atOrUndefined(isolate, 2);
@@ skipping 68 matching lines @@
 
   Handle<JSArrayBuffer> array_buffer = sta->GetBuffer();
   size_t addr = (i << 2) + NumberToSize(sta->byte_offset());
 
   return FutexEmulation::Wait(isolate, array_buffer, addr, value_int32,
                               timeout_number);
 }
 
 }  // namespace internal
 }  // namespace v8