[elements] limit TypedElementsAccessor::IncludesValue to backing store length

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 20e358848a7938c1a13eb7d2126777847dd309e3..7a0f558cd91b26acc84b6c7fafeac379b9d29cae 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -2551,6 +2551,12 @@ class TypedElementsAccessor
       return Just(false);
     }
 
+    // Prototype has no elements, and not searching for the hole --- limit
+    // search to backing store length.
+    if (static_cast<uint32_t>(elements->length()) < length) {
+      length = elements->length();
+    }
+
     if (!std::isnan(search_value)) {
       for (uint32_t k = start_from; k < length; ++k) {
         double element_k = elements->get_scalar(k);