[builtins] treat all elements of detached TypedArray as undefined in A.p.includes

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/elements.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
@@ skipping 2797 matching lines @@
       }
     }
     *nof_items = count;
     return Just(true);
   }
 
   static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                        Handle<JSObject> receiver,
                                        Handle<Object> value,
                                        uint32_t start_from, uint32_t length) {
+    DisallowHeapAllocation no_gc;
     DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
-    DisallowHeapAllocation no_gc;
+
+    // Path should only be reached for JSTypedArrays
+    Handle<JSTypedArray> array = Handle<JSTypedArray>::cast(receiver);
+    Handle<JSArrayBuffer> buffer = array->GetBuffer();
+    if (V8_UNLIKELY(buffer->was_neutered())) {
+      // If buffer was neutered, all accesses yield `undefined`, so return
+      // true if searching for undefined, otherwise false.
+      return Just(value->IsUndefined(isolate) && length > start_from);
+    }
 
     BackingStore* elements = BackingStore::cast(receiver->elements());
     if (value->IsUndefined(isolate) &&
         length > static_cast<uint32_t>(elements->length())) {
       return Just(true);
     }
     if (!value->IsNumber()) return Just(false);
 
     double search_value = value->Number();
 
@@ skipping 1023 matching lines @@
     insertion_index += len;
   }
 
   DCHECK_EQ(insertion_index, result_len);
   return result_array;
 }
 
 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
 }  // namespace internal
 }  // namespace v8