[SAB] Validate index before value conversion

src/builtins/builtins-sharedarraybuffer.cc

Index: src/builtins/builtins-sharedarraybuffer.cc
diff --git a/src/builtins/builtins-sharedarraybuffer.cc b/src/builtins/builtins-sharedarraybuffer.cc
index 0ec8423104d2c6b7933e71bdb6208cb929d7ece6..d7a81a2ffe98634c688f09c8ae48046f93c535fe 100644
--- a/src/builtins/builtins-sharedarraybuffer.cc
+++ b/src/builtins/builtins-sharedarraybuffer.cc
@@ -63,23 +63,15 @@ MUST_USE_RESULT MaybeHandle<JSTypedArray> ValidateSharedIntegerTypedArray(
 MUST_USE_RESULT Maybe<size_t> ValidateAtomicAccess(
     Isolate* isolate, Handle<JSTypedArray> typed_array,
     Handle<Object> request_index) {
-  // TOOD(v8:5961): Use ToIndex for indexes
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, request_index,
-                                   Object::ToNumber(request_index),
-                                   Nothing<size_t>());
-  Handle<Object> offset;
-  ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, offset,
-                                   Object::ToInteger(isolate, request_index),
-                                   Nothing<size_t>());
-  if (!request_index->SameValue(*offset)) {
-    isolate->Throw(*isolate->factory()->NewRangeError(
-        MessageTemplate::kInvalidAtomicAccessIndex));
-    return Nothing<size_t>();
-  }
-  size_t access_index;
-  uint32_t length = typed_array->length_value();
-  if (!TryNumberToSize(*request_index, &access_index) ||
-      access_index >= length) {
+  Handle<Object> access_index_obj;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, access_index_obj,
+      Object::ToIndex(isolate, request_index,
+                      MessageTemplate::kInvalidAtomicAccessIndex),
+      Nothing<size_t>());
+
+  size_t access_index = NumberToSize(*access_index_obj);
+  if (access_index >= typed_array->length_value()) {
     isolate->Throw(*isolate->factory()->NewRangeError(
         MessageTemplate::kInvalidAtomicAccessIndex));
     return Nothing<size_t>();