[elements] limit TypedElementsAccessor::IncludesValue to backing store length

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/elements.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
@@ skipping 2533 matching lines @@
       if (AccessorClass::kind() < FLOAT32_ELEMENTS ||
           AccessorClass::kind() > FLOAT64_ELEMENTS) {
         return Just(false);
       }
     } else if (search_value < std::numeric_limits<ctype>::lowest() ||
                search_value > std::numeric_limits<ctype>::max()) {
       // Return false if value can't be represented in this space
       return Just(false);
     }
 
+    // Prototype has no elements, and not searching for the hole --- limit
+    // search to backing store length.
+    if (static_cast<uint32_t>(elements->length()) < length) {
+      length = elements->length();
+    }
+
     if (!std::isnan(search_value)) {
       for (uint32_t k = start_from; k < length; ++k) {
         double element_k = elements->get_scalar(k);
         if (element_k == search_value) return Just(true);
       }
       return Just(false);
     } else {
       for (uint32_t k = start_from; k < length; ++k) {
         double element_k = elements->get_scalar(k);
         if (std::isnan(element_k)) return Just(true);
@@ skipping 879 matching lines @@
     insertion_index += len;
   }
 
   DCHECK_EQ(insertion_index, result_len);
   return result_array;
 }
 
 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
 }  // namespace internal
 }  // namespace v8