[builtins] fix mapcheck in Array.includes fast-case when searching for String

test/mjsunit/es7/regress/regress-633883.js

Index: test/mjsunit/es7/regress/regress-633883.js
diff --git a/test/message/for-of-throw-in-body.js b/test/mjsunit/es7/regress/regress-633883.js
similarity index 59%
copy from test/message/for-of-throw-in-body.js
copy to test/mjsunit/es7/regress/regress-633883.js
index 38b27f38632520e292f66b7ab451df00c2c03b68..d3a4958da49ae774c378a4bb1d874047b5a65bec 100644
--- a/test/message/for-of-throw-in-body.js
+++ b/test/mjsunit/es7/regress/regress-633883.js
@@ -2,4 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-for (var x of [1, 2, 3]) { throw 42 }
+v5 = new Array();
+v17 = encodeURIComponent(v5);
+v19 = isFinite();
+v34 = new Array(v19);
+v47 = v34.includes(v17);