[elements] update Dictionary in IncludesValue if own elements change

test/mjsunit/es7/regress/regress-634273.js

Index: test/mjsunit/es7/regress/regress-634273.js
diff --git a/test/mjsunit/es7/regress/regress-634273.js b/test/mjsunit/es7/regress/regress-634273.js
new file mode 100644
index 0000000000000000000000000000000000000000..20a0608788dfab938fdb3f24014fe8e237fb7faf
--- /dev/null
+++ b/test/mjsunit/es7/regress/regress-634273.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+var v7 = eval();
+var v8 = eval();
+var v10 = eval();

[Camillo Bruni, 2016/08/04 15:51:57]

nit: can you clean up the test case a bit? Otherwise it looks like all these
things are a requirement :)

(v7-v10) can just be replace with undefined

+v13 = new Array(v10, v10, v7);
+v18 = v13.copyWithin();

[Camillo Bruni, 2016/08/04 15:51:57]

drop this.

+v35 = new WeakMap();
+Object.defineProperty(v18, 0, {

[Camillo Bruni, 2016/08/04 15:51:57]

v18 => v13

+  get: function() {
+    v13.push(v8, v10);
+  }
+});
+v13[0x80000] = 1;
+v48 = v13.includes(v35);

[Camillo Bruni, 2016/08/04 15:51:57]

v35 is just a value that isn't in the array