Fix array.includes(NaN) for sealed/frozen packed element

Bug: chromium:953888
Change-Id: If2aa613bac18e61ac733102b45b0ebb6553eae1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1579539Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60959}

src/elements.cc

@@ -2409,7 +2409,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
           // Search for NaN in PACKED_ELEMENTS, HOLEY_ELEMENTS,
           // PACKED_SMI_ELEMENTS or HOLEY_SMI_ELEMENTS. Return true if
           // elementK->IsHeapNumber() && std::isnan(elementK->Number())
-          DCHECK(IsSmiOrObjectElementsKind(Subclass::kind()));
+          DCHECK(IsSmiOrObjectElementsKind(Subclass::kind()) ||
+                 IsPackedFrozenOrSealedElementsKind(Subclass::kind()));
           auto elements = FixedArray::cast(receiver->elements());
 
           for (uint32_t k = start_from; k < length; ++k) {

test/mjsunit/object-freeze.js

@@ -430,6 +430,8 @@ function testPackedFrozenArray1(obj) {
   assertEquals(obj.indexOf(undefined), 0);
   assertFalse(obj.includes(Symbol("test")));
   assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
   assertEquals(obj.find(x => x==0), undefined);
   assertEquals(obj.findIndex(x => x=='a'), 4);
   assertTrue(obj.some(x => typeof x == 'symbol'));

test/mjsunit/object-prevent-extensions.js

@@ -190,6 +190,8 @@ assertEquals(obj.indexOf('a'), 4);
 assertEquals(obj.indexOf(undefined), 0);
 assertFalse(obj.includes(Symbol("test")));
 assertTrue(obj.includes(undefined));
+assertFalse(obj.includes(NaN));
+assertTrue(obj.includes());
 assertEquals(obj.find(x => x==0), undefined);
 assertEquals(obj.findIndex(x => x=='a'), 4);
 assertTrue(obj.some(x => typeof x == 'symbol'));

test/mjsunit/object-seal.js

@@ -419,6 +419,8 @@ function testPackedSealedArray1(obj) {
   assertEquals(obj.indexOf(undefined), 0);
   assertFalse(obj.includes(Symbol("test")));
   assertTrue(obj.includes(undefined));
+  assertFalse(obj.includes(NaN));
+  assertTrue(obj.includes());
   assertEquals(obj.find(x => x==0), undefined);
   assertEquals(obj.findIndex(x => x=='a'), 4);
   assertTrue(obj.some(x => typeof x == 'symbol'));