Code:  static Maybe<bool> IncludesValueImpl(Isolate* isolate,
 Handle<JSObject> receiver,
 Handle<Object> value,
 uint32_t start_from, uint32_t length) {
    DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver));
 bool search_for_hole = value->IsUndefined(isolate);

 if (!search_for_hole) {
 Maybe<bool> result = Nothing<bool>();
 if (DictionaryElementsAccessor::IncludesValueFastPath(
              isolate, receiver, value, start_from, length, &result)) {

         return result;
       }
     }
     Handle<SeededNumberDictionary> dictionary(
         SeededNumberDictionary::cast(receiver->elements()), isolate);
     for (uint32_t k = start_from; k < length; ++k) {
       int entry = dictionary->FindEntry(isolate, k);
       if (entry == SeededNumberDictionary::kNotFound) {
         if (search_for_hole) return Just(true);
 continue;
 }

 PropertyDetails details = GetDetailsImpl(*dictionary, entry);
 switch (details.kind()) {
 case kData: {
 Object* element_k = dictionary->ValueAt(entry);
 if (value->SameValueZero(element_k)) return Just(true);
 break;
 }
 case kAccessor: {
 LookupIterator it(isolate, receiver, k,
 LookupIterator::OWN_SKIP_INTERCEPTOR);
          DCHECK(it.IsFound());
          DCHECK_EQ(it.state(), LookupIterator::ACCESSOR);
 Handle<Object> element_k;

          ASSIGN_RETURN_ON_EXCEPTION_VALUE(
              isolate, element_k, JSObject::GetPropertyWithAccessor(&it),
 Nothing<bool>());

 if (value->SameValueZero(*element_k)) return Just(true);

 if (!JSObject::PrototypeHasNoElements(isolate, *receiver)) {
 return IncludesValueSlowPath(isolate, receiver, value, k + 1,
                                         length);
 }

 if (*dictionary == receiver->elements()) continue;

 if (receiver->GetElementsKind() != DICTIONARY_ELEMENTS) {
 if (receiver->map()->GetInitialElements() == receiver->elements()) {
 return Just(search_for_hole);
 }
 return IncludesValueSlowPath(isolate, receiver, value, k + 1,
                                         length);
 }
          dictionary = handle(
 SeededNumberDictionary::cast(receiver->elements()), isolate);
 break;
 }
 }
 }
 return Just(false);
 }

Vulnerability Type: Exec Code 
CWE ID: CWE-704
Summary: In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111274046
Commit Message: Backport: Fix Object.entries/values with changing elements

Bug: 111274046
Test: m -j proxy_resolver_v8_unittest && adb sync && adb shell \
/data/nativetest64/proxy_resolver_v8_unittest/proxy_resolver_v8_unittest
Change-Id: I705fc512cc5837e9364ed187559cc75d079aa5cb
(cherry picked from commit d8be9a10287afed07705ac8af027d6a46d4def99)
