v8/test/mjsunit/es7/regress/regress-5986.js

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

// Flags: --allow-natives-syntax
var array = [1.7, 1.7, 1.7];
var mutator = {
  [Symbol.toPrimitive]() {
    Object.defineProperties(
        array, {0: {get() {}}, 1: {get() {}}, 2: {get() {}}});

    return 0;
  }
};

assertTrue(array.includes(undefined, mutator));

function search(array, searchElement, startIndex) {
  return array.includes(searchElement, startIndex);
};
%PrepareFunctionForOptimization(search);
array = [1.7, 1.7, 1.7];
var not_mutator = {
  [Symbol.toPrimitive]() {
    return 0;
  }
};
assertFalse(search(array, undefined, not_mutator));
assertFalse(search(array, undefined, not_mutator));
%OptimizeFunctionOnNextCall(search);
assertTrue(search(array, undefined, mutator));