VULNERABILITY DETAILS
The following testcase crashes the latest trunk build of d8 on ARM64

VERSION
Chrome Version: trunk build of d8 on ARM64
Operating System: Linux ARM64

REPRODUCTION CASE
o1=[1.1,2.2,3.3];
o14=[1.1,2.2,3.3];
o14.toString=f;
o1['push'](undefined,1,o14,24,14);
o67=[1.1,2.2,3.3];
o67['includes'](19,o1,'A',undefined);
function f() {
        o67['splice']('A');
}

Type of crash: assertion
Crash State: 

# Fatal error in ../../src/objects/fixed-array-inl.h, line 25
# Check failed: !v8::internal::FLAG_enable_slow_asserts || (object->IsFixedDoubleArray()).

(lldb) bt 10
* thread #1, name = 'd8', stop reason = signal SIGTRAP
  * frame #0: 0x0000005556dc9580 d8`v8::base::OS::Abort() at platform-posix.cc:397
    frame #1: 0x0000005556dc2b80 d8`V8_Fatal(file=<unavailable>, line=<unavailable>, format=<unavailable>) at logging.cc:171
    frame #2: 0x0000005555f5263c d8`v8::internal::(anonymous namespace)::ElementsAccessorBase<v8::internal::(anonymous namespace)::FastPackedDoubleElementsAccessor, v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)4> >::IncludesValue(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSObject>, v8::internal::Handle<v8::internal::Object>, unsigned int, unsigned int) [inlined] v8::internal::(anonymous namespace)::FastElementsAccessor<v8::internal::(isolate=<unavailable>, receiver=Handle<v8::internal::JSObject> @ 0x0000007fffffe638, search_value=Handle<v8::internal::Object> @ 0x0000007fffffe628, start_from=0, length=0)::FastPackedDoubleElementsAccessor, v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)4> >::IncludesValueImpl(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSObject>, v8::internal::Handle<v8::internal::Object>, unsigned int, unsigned int) at elements.cc:0
    frame #3: 0x0000005555f5237c d8`v8::internal::(anonymous namespace)::ElementsAccessorBase<v8::internal::(this=<unavailable>, isolate=<unavailable>, receiver=<unavailable>, value=<unavailable>, start_from=0, length=3)::FastPackedDoubleElementsAccessor, v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)4> >::IncludesValue(v8::internal::Isolate*, v8::internal::Handle<v8::internal::JSObject>, v8::internal::Handle<v8::internal::Object>, unsigned int, unsigned int) at elements.cc:1305
    frame #4: 0x00000055563e3a54 d8`v8::internal::__RT_impl_Runtime_ArrayIncludes_Slow(args=<unavailable>, isolate=<unavailable>) at runtime-array.cc:806
    frame #5: 0x0000005556a8fc48 d8`Builtins_CEntry_Return1_DontSaveFPRegs_ArgvOnStack_NoBuiltinExit + 136
    frame #6: 0x00000055567f2580 d8`Builtins_ArrayIncludes + 1792
    frame #7: 0x0000000024493bb0
    frame #8: 0x0000005556787fec d8`Builtins_JSEntryTrampoline + 172
    frame #9: 0x000000002448215c