function foo(n) {
    return ("aaa").includes("", n)
}
noInline(foo);
for (var m = 0; m < 200; ++m) {
  print(foo(m));
}

With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=1

According to ECMAScript Language Specification, when the first parameter of String.prototype.includes is empty, the result should be true regardless of whether the second parameter is greater than length. However, JSC prints false when n exceeds length.

The problem is in StringPrototype.cpp stringIncluesImpl. When positionArg is Int32, it should be clamped. Otherwise, the function findCommon will return notFound and the final result will be false.