[JSC] Add some missing exception checks to arrayProtoFuncIncludes

https://bugs.webkit.org/show_bug.cgi?id=288416
rdar://145514228

Reviewed by Yijia Huang and Michael Saboff.

Need to keep the exception check verifier happy.

* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):

Canonical link: https://commits.webkit.org/290995@main

Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -2157,14 +2157,18 @@ JSC_DEFINE_HOST_FUNCTION(arrayProtoFuncIncludes, (JSGlobalObject* globalObject,
 
     if (LIKELY(isJSArray(thisObject))) {
         JSArray* thisArray = jsCast<JSArray*>(thisObject);
-        if (auto fastResult = thisArray->fastIncludes(globalObject, searchElement, index, length))
+        auto fastResult = thisArray->fastIncludes(globalObject, searchElement, index, length);
+        RETURN_IF_EXCEPTION(scope, { });
+        if (fastResult)
             return JSValue::encode(jsBoolean(fastResult.value()));
     }
 
     for (; index < length; ++index) {
         auto currentElement = thisObject->getIndex(globalObject, index);
         RETURN_IF_EXCEPTION(scope, { });
-        if (sameValueZero(globalObject, searchElement, currentElement))
+        bool isEqual = sameValueZero(globalObject, searchElement, currentElement);
+        RETURN_IF_EXCEPTION(scope, { });
+        if (isEqual)
             return JSValue::encode(jsBoolean(true));
     }