[builtins] treat all elements of detached TypedArray as undefined in A.p.includes

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index 12bc26506a46cad26257fff0eba531707fa81166..096e5a13fb44e956d6a2f8c0c87d8e350def908b 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -2815,8 +2815,17 @@ class TypedElementsAccessor
                                        Handle<JSObject> receiver,
                                        Handle<Object> value,
                                        uint32_t start_from, uint32_t length) {
-    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
     DisallowHeapAllocation no_gc;
+    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
+
+    // Path should only be reached for JSTypedArrays
+    Handle<JSTypedArray> array = Handle<JSTypedArray>::cast(receiver);
+    Handle<JSArrayBuffer> buffer = array->GetBuffer();
+    if (V8_UNLIKELY(buffer->was_neutered())) {
+      // If buffer was neutered, all accesses yield `undefined`, so return
+      // true if searching for undefined, otherwise false.
+      return Just(value->IsUndefined(isolate) && length > start_from);
+    }
 
     BackingStore* elements = BackingStore::cast(receiver->elements());
     if (value->IsUndefined(isolate) &&