Fix array.includes undefined for sealed/frozen object

For slow-path of array.includes, it should be able to handle if arguments is undefined for sealed/frozen object

Bug: chromium:951780
Change-Id: I42dcf1e23ab07bfcd87e7a5d27b52e66b2d1d2ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565031Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60829}

src/elements.cc

@@ -2307,7 +2307,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
         // PACKED_DOUBLE_ELEMENTS or PACKED_SMI_ELEMENTS, we might encounter The
         // Hole here, since the {length} used here can be larger than
         // JSArray::length.
-        if (IsSmiOrObjectElementsKind(Subclass::kind())) {
+        if (IsSmiOrObjectElementsKind(Subclass::kind()) ||
+            IsFrozenOrSealedElementsKind(Subclass::kind())) {
           auto elements = FixedArray::cast(receiver->elements());
 
           for (uint32_t k = start_from; k < length; ++k) {

test/mjsunit/object-freeze.js

@@ -426,7 +426,9 @@ function testPackedFrozenArray1(obj) {
   // Verify search, filter, iterator
   assertEquals(obj.lastIndexOf(1), 2);
   assertEquals(obj.indexOf('a'), 4);
+  assertEquals(obj.indexOf(undefined), 0);
   assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
   assertEquals(obj.find(x => x==0), undefined);
   assertEquals(obj.findIndex(x => x=='a'), 4);
   assertTrue(obj.some(x => typeof x == 'symbol'));

test/mjsunit/object-prevent-extensions.js

@@ -186,7 +186,9 @@ assertFalse(Object.isExtensible(obj));
 assertTrue(Array.isArray(obj));
 assertEquals(obj.lastIndexOf(1), 2);
 assertEquals(obj.indexOf('a'), 4);
+assertEquals(obj.indexOf(undefined), 0);
 assertFalse(obj.includes(Symbol("test")));
+assertTrue(obj.includes(undefined));
 assertEquals(obj.find(x => x==0), undefined);
 assertEquals(obj.findIndex(x => x=='a'), 4);
 assertTrue(obj.some(x => typeof x == 'symbol'));

test/mjsunit/object-seal.js

@@ -415,7 +415,9 @@ function testPackedSealedArray1(obj) {
   assertTrue(Array.isArray(obj));
   assertEquals(obj.lastIndexOf(1), 2);
   assertEquals(obj.indexOf('a'), 4);
+  assertEquals(obj.indexOf(undefined), 0);
   assertFalse(obj.includes(Symbol("test")));
+  assertTrue(obj.includes(undefined));
   assertEquals(obj.find(x => x==0), undefined);
   assertEquals(obj.findIndex(x => x=='a'), 4);
   assertTrue(obj.some(x => typeof x == 'symbol'));