Import relevant files from #3888

test/built-ins/Array/prototype/includes/coerced-searchelement-fromindex-resize.js

@@ -0,0 +1,134 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.includes
+description: >
+  Array.p.includes behaves correctly when the receiver is resized during
+  argument coercion
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+class MyUint8Array extends Uint8Array {
+}
+
+class MyFloat32Array extends Float32Array {
+}
+
+class MyBigInt64Array extends BigInt64Array {
+}
+
+const builtinCtors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Float32Array,
+  Float64Array,
+  Uint8ClampedArray,
+  BigUint64Array,
+  BigInt64Array
+];
+
+const ctors = [
+  ...builtinCtors,
+  MyUint8Array,
+  MyFloat32Array,
+  MyBigInt64Array
+];
+
+function CreateResizableArrayBuffer(byteLength, maxByteLength) {
+  return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
+}
+
+function WriteToTypedArray(array, index, value) {
+  if (array instanceof BigInt64Array || array instanceof BigUint64Array) {
+    array[index] = BigInt(value);
+  } else {
+    array[index] = value;
+  }
+}
+
+function ArrayIncludesHelper(array, n, fromIndex) {
+  if (typeof n == 'number' && (array instanceof BigInt64Array || array instanceof BigUint64Array)) {
+    return Array.prototype.includes.call(array, BigInt(n), fromIndex);
+  }
+  return Array.prototype.includes.call(array, n, fromIndex);
+}
+
+function IncludesParameterConversionResizes() {
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    let evil = {
+      valueOf: () => {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(!ArrayIncludesHelper(fixedLength, undefined));
+    // The TA is OOB so it includes only "undefined".
+    assert(ArrayIncludesHelper(fixedLength, undefined, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    let evil = {
+      valueOf: () => {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(ArrayIncludesHelper(fixedLength, 0));
+    // The TA is OOB so it includes only "undefined".
+    assert(!ArrayIncludesHelper(fixedLength, 0, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const lengthTracking = new ctor(rab);
+    let evil = {
+      valueOf: () => {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(!ArrayIncludesHelper(lengthTracking, undefined));
+    // "includes" iterates until the original length and sees "undefined"s.
+    assert(ArrayIncludesHelper(lengthTracking, undefined, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const lengthTracking = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(lengthTracking, i, 1);
+    }
+    let evil = {
+      valueOf: () => {
+        rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(!ArrayIncludesHelper(lengthTracking, 0));
+    // The TA grew but we only look at the data until the original length.
+    assert(!ArrayIncludesHelper(lengthTracking, 0, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const lengthTracking = new ctor(rab);
+    WriteToTypedArray(lengthTracking, 0, 1);
+    let evil = {
+      valueOf: () => {
+        rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+        return -4;
+      }
+    };
+    assert(ArrayIncludesHelper(lengthTracking, 1, -4));
+    // The TA grew but the start index conversion is done based on the original
+    // length.
+    assert(ArrayIncludesHelper(lengthTracking, 1, evil));
+  }
+}
+
+IncludesParameterConversionResizes();

test/built-ins/Array/prototype/includes/resizable-buffer.js

@@ -0,0 +1,168 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.includes
+description: >
+  Array.p.includes behaves correctly when receiver is backed by resizable
+  buffer
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+class MyUint8Array extends Uint8Array {
+}
+
+class MyFloat32Array extends Float32Array {
+}
+
+class MyBigInt64Array extends BigInt64Array {
+}
+
+const builtinCtors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Float32Array,
+  Float64Array,
+  Uint8ClampedArray,
+  BigUint64Array,
+  BigInt64Array
+];
+
+const ctors = [
+  ...builtinCtors,
+  MyUint8Array,
+  MyFloat32Array,
+  MyBigInt64Array
+];
+
+function CreateResizableArrayBuffer(byteLength, maxByteLength) {
+  return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
+}
+
+function WriteToTypedArray(array, index, value) {
+  if (array instanceof BigInt64Array || array instanceof BigUint64Array) {
+    array[index] = BigInt(value);
+  } else {
+    array[index] = value;
+  }
+}
+
+function ArrayIncludesHelper(array, n, fromIndex) {
+  if (typeof n == 'number' && (array instanceof BigInt64Array || array instanceof BigUint64Array)) {
+    return Array.prototype.includes.call(array, BigInt(n), fromIndex);
+  }
+  return Array.prototype.includes.call(array, n, fromIndex);
+}
+
+function TestIncludes() {
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new ctor(rab, 0);
+    const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, ...] << lengthTracking
+    //                    [4, 6, ...] << lengthTrackingWithOffset
+
+    assert(ArrayIncludesHelper(fixedLength, 2));
+    assert(!ArrayIncludesHelper(fixedLength, undefined));
+    assert(ArrayIncludesHelper(fixedLength, 2, 1));
+    assert(!ArrayIncludesHelper(fixedLength, 2, 2));
+    assert(ArrayIncludesHelper(fixedLength, 2, -3));
+    assert(!ArrayIncludesHelper(fixedLength, 2, -2));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 2));
+    assert(ArrayIncludesHelper(fixedLengthWithOffset, 4));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, undefined));
+    assert(ArrayIncludesHelper(fixedLengthWithOffset, 4, 0));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 4, 1));
+    assert(ArrayIncludesHelper(fixedLengthWithOffset, 4, -2));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 4, -1));
+    assert(ArrayIncludesHelper(lengthTracking, 2));
+    assert(!ArrayIncludesHelper(lengthTracking, undefined));
+    assert(ArrayIncludesHelper(lengthTracking, 2, 1));
+    assert(!ArrayIncludesHelper(lengthTracking, 2, 2));
+    assert(ArrayIncludesHelper(lengthTracking, 2, -3));
+    assert(!ArrayIncludesHelper(lengthTracking, 2, -2));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, 2));
+    assert(ArrayIncludesHelper(lengthTrackingWithOffset, 4));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, undefined));
+    assert(ArrayIncludesHelper(lengthTrackingWithOffset, 4, 0));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, 4, 1));
+    assert(ArrayIncludesHelper(lengthTrackingWithOffset, 4, -2));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, 4, -1));
+
+    // Shrink so that fixed length TAs go out of bounds.
+    rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+    // Orig. array: [0, 2, 4]
+    //              [0, 2, 4, ...] << lengthTracking
+    //                    [4, ...] << lengthTrackingWithOffset
+
+    assert(!ArrayIncludesHelper(fixedLength, 2));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 2));
+
+    assert(ArrayIncludesHelper(lengthTracking, 2));
+    assert(!ArrayIncludesHelper(lengthTracking, undefined));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, 2));
+    assert(ArrayIncludesHelper(lengthTrackingWithOffset, 4));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, undefined));
+
+    // Shrink so that the TAs with offset go out of bounds.
+    rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+    assert(!ArrayIncludesHelper(fixedLength, 2));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 2));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, 2));
+
+    // Shrink to zero.
+    rab.resize(0);
+    assert(!ArrayIncludesHelper(fixedLength, 2));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 2));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, 2));
+
+    assert(!ArrayIncludesHelper(lengthTracking, 2));
+    assert(!ArrayIncludesHelper(lengthTracking, undefined));
+
+    // Grow so that all TAs are back in-bounds.
+    rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+    for (let i = 0; i < 6; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6, 8, 10]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+    //                    [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+
+    assert(ArrayIncludesHelper(fixedLength, 2));
+    assert(!ArrayIncludesHelper(fixedLength, undefined));
+    assert(!ArrayIncludesHelper(fixedLength, 8));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 2));
+    assert(ArrayIncludesHelper(fixedLengthWithOffset, 4));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, undefined));
+    assert(!ArrayIncludesHelper(fixedLengthWithOffset, 8));
+    assert(ArrayIncludesHelper(lengthTracking, 2));
+    assert(!ArrayIncludesHelper(lengthTracking, undefined));
+    assert(ArrayIncludesHelper(lengthTracking, 8));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, 2));
+    assert(ArrayIncludesHelper(lengthTrackingWithOffset, 4));
+    assert(!ArrayIncludesHelper(lengthTrackingWithOffset, undefined));
+    assert(ArrayIncludesHelper(lengthTrackingWithOffset, 8));
+  }
+}
+
+TestIncludes();

test/built-ins/TypedArray/prototype/includes/coerced-searchelement-fromindex-resize.js

@@ -0,0 +1,134 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.includes
+description: >
+  TypedArray.p.includes behaves correctly when the receiver is resized during
+  argument coercion
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+class MyUint8Array extends Uint8Array {
+}
+
+class MyFloat32Array extends Float32Array {
+}
+
+class MyBigInt64Array extends BigInt64Array {
+}
+
+const builtinCtors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Float32Array,
+  Float64Array,
+  Uint8ClampedArray,
+  BigUint64Array,
+  BigInt64Array
+];
+
+const ctors = [
+  ...builtinCtors,
+  MyUint8Array,
+  MyFloat32Array,
+  MyBigInt64Array
+];
+
+function CreateResizableArrayBuffer(byteLength, maxByteLength) {
+  return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
+}
+
+function WriteToTypedArray(array, index, value) {
+  if (array instanceof BigInt64Array || array instanceof BigUint64Array) {
+    array[index] = BigInt(value);
+  } else {
+    array[index] = value;
+  }
+}
+
+function TypedArrayIncludesHelper(array, n, fromIndex) {
+  if (typeof n == 'number' && (array instanceof BigInt64Array || array instanceof BigUint64Array)) {
+    return array.includes(BigInt(n), fromIndex);
+  }
+  return array.includes(n, fromIndex);
+}
+
+function IncludesParameterConversionResizes() {
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    let evil = {
+      valueOf: () => {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(!TypedArrayIncludesHelper(fixedLength, undefined));
+    // The TA is OOB so it includes only "undefined".
+    assert(TypedArrayIncludesHelper(fixedLength, undefined, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    let evil = {
+      valueOf: () => {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(TypedArrayIncludesHelper(fixedLength, 0));
+    // The TA is OOB so it includes only "undefined".
+    assert(!TypedArrayIncludesHelper(fixedLength, 0, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const lengthTracking = new ctor(rab);
+    let evil = {
+      valueOf: () => {
+        rab.resize(2 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(!TypedArrayIncludesHelper(lengthTracking, undefined));
+    // "includes" iterates until the original length and sees "undefined"s.
+    assert(TypedArrayIncludesHelper(lengthTracking, undefined, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const lengthTracking = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(lengthTracking, i, 1);
+    }
+    let evil = {
+      valueOf: () => {
+        rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+        return 0;
+      }
+    };
+    assert(!TypedArrayIncludesHelper(lengthTracking, 0));
+    // The TA grew but we only look at the data until the original length.
+    assert(!TypedArrayIncludesHelper(lengthTracking, 0, evil));
+  }
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const lengthTracking = new ctor(rab);
+    WriteToTypedArray(lengthTracking, 0, 1);
+    let evil = {
+      valueOf: () => {
+        rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+        return -4;
+      }
+    };
+    assert(TypedArrayIncludesHelper(lengthTracking, 1, -4));
+    // The TA grew but the start index conversion is done based on the original
+    // length.
+    assert(TypedArrayIncludesHelper(lengthTracking, 1, evil));
+  }
+}
+
+IncludesParameterConversionResizes();

test/built-ins/TypedArray/prototype/includes/resizable-buffer-special-float-values.js

@@ -0,0 +1,34 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.includes
+description: >
+  TypedArray.p.includes behaves correctly for special float values when
+  receiver is a float TypedArray backed by a resizable buffer
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+class MyFloat32Array extends Float32Array {
+}
+
+const floatCtors = [
+  Float32Array,
+  Float64Array,
+  MyFloat32Array
+];
+
+function CreateResizableArrayBuffer(byteLength, maxByteLength) {
+  return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
+}
+
+for (let ctor of floatCtors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const lengthTracking = new ctor(rab);
+  lengthTracking[0] = -Infinity;
+  lengthTracking[1] = Infinity;
+  lengthTracking[2] = NaN;
+  assert(lengthTracking.includes(-Infinity));
+  assert(lengthTracking.includes(Infinity));
+  assert(lengthTracking.includes(NaN));
+}

test/built-ins/TypedArray/prototype/includes/resizable-buffer.js

@@ -0,0 +1,183 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.includes
+description: >
+  TypedArray.p.includes behaves correctly when receiver is backed by resizable
+  buffer
+features: [resizable-arraybuffer, Array.prototype.includes]
+---*/
+
+class MyUint8Array extends Uint8Array {
+}
+
+class MyFloat32Array extends Float32Array {
+}
+
+class MyBigInt64Array extends BigInt64Array {
+}
+
+const builtinCtors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Float32Array,
+  Float64Array,
+  Uint8ClampedArray,
+  BigUint64Array,
+  BigInt64Array
+];
+
+const ctors = [
+  ...builtinCtors,
+  MyUint8Array,
+  MyFloat32Array,
+  MyBigInt64Array
+];
+
+function CreateResizableArrayBuffer(byteLength, maxByteLength) {
+  return new ArrayBuffer(byteLength, { maxByteLength: maxByteLength });
+}
+
+function WriteToTypedArray(array, index, value) {
+  if (array instanceof BigInt64Array || array instanceof BigUint64Array) {
+    array[index] = BigInt(value);
+  } else {
+    array[index] = value;
+  }
+}
+
+function TypedArrayIncludesHelper(array, n, fromIndex) {
+  if (typeof n == 'number' && (array instanceof BigInt64Array || array instanceof BigUint64Array)) {
+    return array.includes(BigInt(n), fromIndex);
+  }
+  return array.includes(n, fromIndex);
+}
+
+function TestIncludes() {
+  for (let ctor of ctors) {
+    const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+    const fixedLength = new ctor(rab, 0, 4);
+    const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+    const lengthTracking = new ctor(rab, 0);
+    const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+    // Write some data into the array.
+    const taWrite = new ctor(rab);
+    for (let i = 0; i < 4; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, ...] << lengthTracking
+    //                    [4, 6, ...] << lengthTrackingWithOffset
+
+    assert(TypedArrayIncludesHelper(fixedLength, 2));
+    assert(!TypedArrayIncludesHelper(fixedLength, undefined));
+    assert(TypedArrayIncludesHelper(fixedLength, 2, 1));
+    assert(!TypedArrayIncludesHelper(fixedLength, 2, 2));
+    assert(TypedArrayIncludesHelper(fixedLength, 2, -3));
+    assert(!TypedArrayIncludesHelper(fixedLength, 2, -2));
+    assert(!TypedArrayIncludesHelper(fixedLengthWithOffset, 2));
+    assert(TypedArrayIncludesHelper(fixedLengthWithOffset, 4));
+    assert(!TypedArrayIncludesHelper(fixedLengthWithOffset, undefined));
+    assert(TypedArrayIncludesHelper(fixedLengthWithOffset, 4, 0));
+    assert(!TypedArrayIncludesHelper(fixedLengthWithOffset, 4, 1));
+    assert(TypedArrayIncludesHelper(fixedLengthWithOffset, 4, -2));
+    assert(!TypedArrayIncludesHelper(fixedLengthWithOffset, 4, -1));
+    assert(TypedArrayIncludesHelper(lengthTracking, 2));
+    assert(!TypedArrayIncludesHelper(lengthTracking, undefined));
+    assert(TypedArrayIncludesHelper(lengthTracking, 2, 1));
+    assert(!TypedArrayIncludesHelper(lengthTracking, 2, 2));
+    assert(TypedArrayIncludesHelper(lengthTracking, 2, -3));
+    assert(!TypedArrayIncludesHelper(lengthTracking, 2, -2));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, 2));
+    assert(TypedArrayIncludesHelper(lengthTrackingWithOffset, 4));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, undefined));
+    assert(TypedArrayIncludesHelper(lengthTrackingWithOffset, 4, 0));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, 4, 1));
+    assert(TypedArrayIncludesHelper(lengthTrackingWithOffset, 4, -2));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, 4, -1));
+
+    // Shrink so that fixed length TAs go out of bounds.
+    rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+    // Orig. array: [0, 2, 4]
+    //              [0, 2, 4, ...] << lengthTracking
+    //                    [4, ...] << lengthTrackingWithOffset
+
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(fixedLength, 2);
+    });
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(fixedLengthWithOffset, 2);
+    });
+
+    assert(TypedArrayIncludesHelper(lengthTracking, 2));
+    assert(!TypedArrayIncludesHelper(lengthTracking, undefined));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, 2));
+    assert(TypedArrayIncludesHelper(lengthTrackingWithOffset, 4));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, undefined));
+
+    // Shrink so that the TAs with offset go out of bounds.
+    rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(fixedLength, 2);
+    });
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(fixedLengthWithOffset, 2);
+    });
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(lengthTrackingWithOffset, 2);
+    });
+
+    // Shrink to zero.
+    rab.resize(0);
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(fixedLength, 2);
+    });
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(fixedLengthWithOffset, 2);
+    });
+    assert.throws(TypeError, () => {
+      TypedArrayIncludesHelper(lengthTrackingWithOffset, 2);
+    });
+    assert(!TypedArrayIncludesHelper(lengthTracking, 2));
+    assert(!TypedArrayIncludesHelper(lengthTracking, undefined));
+
+    // Grow so that all TAs are back in-bounds.
+    rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+    for (let i = 0; i < 6; ++i) {
+      WriteToTypedArray(taWrite, i, 2 * i);
+    }
+
+    // Orig. array: [0, 2, 4, 6, 8, 10]
+    //              [0, 2, 4, 6] << fixedLength
+    //                    [4, 6] << fixedLengthWithOffset
+    //              [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+    //                    [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+
+    assert(TypedArrayIncludesHelper(fixedLength, 2));
+    assert(!TypedArrayIncludesHelper(fixedLength, undefined));
+    assert(!TypedArrayIncludesHelper(fixedLength, 8));
+    assert(!TypedArrayIncludesHelper(fixedLengthWithOffset, 2));
+    assert(TypedArrayIncludesHelper(fixedLengthWithOffset, 4));
+    assert(!TypedArrayIncludesHelper(fixedLengthWithOffset, undefined));
+    assert(!TypedArrayIncludesHelper(fixedLengthWithOffset, 8));
+    assert(TypedArrayIncludesHelper(lengthTracking, 2));
+    assert(!TypedArrayIncludesHelper(lengthTracking, undefined));
+    assert(TypedArrayIncludesHelper(lengthTracking, 8));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, 2));
+    assert(TypedArrayIncludesHelper(lengthTrackingWithOffset, 4));
+    assert(!TypedArrayIncludesHelper(lengthTrackingWithOffset, undefined));
+    assert(TypedArrayIncludesHelper(lengthTrackingWithOffset, 8));
+  }
+}
+
+TestIncludes();