1 files changed, 33 insertions, 0 deletions
diff --git a/js/src/tests/test262/built-ins/Set/prototype/isSupersetOf/set-like-class-mutation.js b/js/src/tests/test262/built-ins/Set/prototype/isSupersetOf/set-like-class-mutation.js
new file mode 100644
index 0000000000..aa5743efe7
--- /dev/null
+++ b/js/src/tests/test262/built-ins/Set/prototype/isSupersetOf/set-like-class-mutation.js
@@ -0,0 +1,33 @@
+// |reftest| skip -- set-methods is not supported
+// Copyright (C) 2023 Anthony Frehner and Kevin Gibbons. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-set.prototype.issupersetof
+description: Set.prototype.isSupersetOf behavior when a custom Set-like class mutates the receiver
+features: [set-methods]
+includes: [compareArray.js]
+---*/
+
+const baseSet = new Set(["a", "b", "c"]);
+
+const evilSetLike = {
+  size: 3,
+  has(v) {
+    throw new Test262Error("Set.prototype.isSupersetOf should not call its argument's has method");
+  },
+  * keys() {
+    yield "a";
+    baseSet.delete("b");
+    baseSet.delete("c");
+    baseSet.add("b");
+    yield "b";
+  },
+};
+
+const result = baseSet.isSupersetOf(evilSetLike);
+assert.sameValue(result, true);
+
+const expectedNewBase = ["a", "b"];
+assert.compareArray([...baseSet], expectedNewBase);
+
+reportCompare(0, 0);