1 files changed, 32 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/Array/prototype/toReversed/length-increased-while-iterating.js b/js/src/tests/test262/built-ins/Array/prototype/toReversed/length-increased-while-iterating.js
new file mode 100644
index 0000000000..90c87de7d0
--- /dev/null
+++ b/js/src/tests/test262/built-ins/Array/prototype/toReversed/length-increased-while-iterating.js
@@ -0,0 +1,32 @@
+// Copyright (C) 2021 Igalia, S.L. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.toReversed
+description: >
+  Array.prototype.toReversed caches the length getting the array elements.
+info: |
+  Array.prototype.toReversed ( )
+
+  ...
+  2. Let len be ? LengthOfArrayLike(O).
+  ...
+  5. Repeat, while k < len
+    ...
+    c. Let fromValue be ? Get(O, from).
+    ...
+features: [change-array-by-copy]
+includes: [compareArray.js]
+---*/
+
+var arr = [0, 1, 2];
+Object.defineProperty(arr, "0", {
+  get() {
+    arr.push(4);
+    return 0;
+  }
+});
+
+assert.compareArray(arr.toReversed(), [2, 1, 0]);
+
+reportCompare(0, 0);