fix: Ensure overloaded Array.prototype won't crash axe

lib/core/public/load.js

@@ -10,7 +10,7 @@ function runCommand(data, keepalive, callback) {
 	};
 
 	var context = (data && data.context) || {};
-	if (context.include && !context.include.length) {
+	if (context.hasOwnProperty('include') && !context.include.length) {
 		context.include = [document];
 	}
 	var options = (data && data.options) || {};

lib/core/utils/rule-should-run.js

@@ -12,7 +12,7 @@ function matchTags(rule, runOnly) {
 	var defaultExclude = (axe._audit && axe._audit.tagExclude) ? axe._audit.tagExclude : [];
 
 	// normalize include/exclude
-	if (runOnly.include || runOnly.exclude) {
+	if (runOnly.hasOwnProperty('include') || runOnly.hasOwnProperty('exclude')) {
 		// Wrap include and exclude if it's not already an array
 		include = runOnly.include || [];
 		include = Array.isArray(include) ? include : [include];

test/core/public/run-rules.js

@@ -67,7 +67,6 @@ describe('runRules', function () {
 			}
 		}], messages: {}});
 
-
 		var frame = document.createElement('iframe');
 		frame.src = '../mock/frames/frame-frame.html';
 
@@ -621,4 +620,31 @@ describe('runRules', function () {
 		});
 		fixture.appendChild(frame);
 	});
+
+	it('should not fail if `include` / `exclude` is overwritten', function (done) {
+		function invalid () {
+			throw new Error('nope!');
+		}
+		Array.prototype.include = invalid;
+		Array.prototype.exclude = invalid;
+
+		axe._load({ rules: [{
+			id: 'html',
+			selector: 'html',
+			any: ['html']
+		}], checks: [{
+			id: 'html',
+			evaluate: function () {
+				return true;
+			}
+		}], messages: {}});
+
+		runRules([document], {}, function (r) {
+			assert.lengthOf(r[0].passes, 1);
+
+			delete Array.prototype.include;
+			delete Array.prototype.exclude;
+			done();
+		}, isNotCalled);
+	});
 });