[elements] update Dictionary in IncludesValue if own elements change

Ensure that receiver->elements() == *dictionary after calling an accessor, in
addition to checking the prototype.

BUG=chromium:634273, chromium: 634357, v8:5162
R=cbruni@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2212963002
Cr-Commit-Position: refs/heads/master@{#38347}

src/elements.cc

@@ -1519,7 +1519,7 @@ class DictionaryElementsAccessor
         continue;
       }
 
-      PropertyDetails details = GetDetailsImpl(receiver->elements(), entry);
+      PropertyDetails details = GetDetailsImpl(*dictionary, entry);
       switch (details.kind()) {
         case kData: {
           Object* element_k = dictionary->ValueAt(entry);
@@ -1539,12 +1539,28 @@ class DictionaryElementsAccessor
 
           if (value->SameValueZero(*element_k)) return Just(true);
 
-          // Some mutation to the prototype elements may have occurred in
-          // accessor.
+          // Bailout to slow path if elements on prototype changed
           if (!JSObject::PrototypeHasNoElements(isolate, *receiver)) {
             return IncludesValueSlowPath(isolate, receiver, value, k + 1,
                                          length);
           }
+
+          // Continue if elements unchanged
+          if (*dictionary == receiver->elements()) continue;
+
+          // Otherwise, bailout or update elements
+          if (receiver->GetElementsKind() != DICTIONARY_ELEMENTS) {
+            if (receiver->map()->GetInitialElements() == receiver->elements()) {
+              // If switched to initial elements, return true if searching for
+              // undefined, and false otherwise.
+              return Just(search_for_hole);
+            }
+            // Otherwise, switch to slow path.
+            return IncludesValueSlowPath(isolate, receiver, value, k + 1,
+                                         length);
+          }
+          dictionary = handle(
+              SeededNumberDictionary::cast(receiver->elements()), isolate);
           break;
         }
       }

test/mjsunit/es7/regress/regress-634273.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+array = new Array(undefined, undefined, undefined);
+Object.defineProperty(array, 0, {
+  get: function() {
+    array.push(undefined, undefined);
+  }
+});
+array[0x80000] = 1;
+result = array.includes(new WeakMap());

test/mjsunit/es7/regress/regress-634357.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+array = new Array({}, {}, {});
+Object.defineProperty(array, 1, {
+  get: function() {
+    array.length = 0;
+    array[0] = -2147483648;
+  }
+});
+result = array.includes(new Intl.Collator());