[array] Add HandleScope in Array.p.includes slow path

The HandleScope lets objects allocated within the slow loop be collected
prior to loop termination.

Drive-by: Use the appropriate kMaxElementCount constant.
Drive-by: Switch to less-or-equal comparison against it.

Bug: chromium:948810
Change-Id: I2449408b87e7e82dead5ee76d8c92129fa3243fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1736749
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63103}

src/runtime/runtime-array.cc

@@ -272,7 +272,8 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
 
   // If the receiver is not a special receiver type, and the length is a valid
   // element index, perform fast operation tailored to specific ElementsKinds.
-  if (!object->map().IsSpecialReceiverMap() && len < kMaxUInt32 &&
+  if (!object->map().IsSpecialReceiverMap() &&
+      len <= JSObject::kMaxElementCount &&
       JSObject::PrototypeHasNoElements(isolate, JSObject::cast(*object))) {
     Handle<JSObject> obj = Handle<JSObject>::cast(object);
     ElementsAccessor* elements = obj->GetElementsAccessor();
@@ -283,8 +284,10 @@ RUNTIME_FUNCTION(Runtime_ArrayIncludes_Slow) {
     return *isolate->factory()->ToBoolean(result.FromJust());
   }
 
-  // Otherwise, perform slow lookups for special receiver types
+  // Otherwise, perform slow lookups for special receiver types.
   for (; index < len; ++index) {
+    HandleScope iteration_hs(isolate);
+
     // Let elementK be the result of ? Get(O, ! ToString(k)).
     Handle<Object> element_k;
     {