diff --git a/test/built-ins/Array/prototype/keys/resizable-buffer-grow-mid-iteration.js b/test/built-ins/Array/prototype/keys/resizable-buffer-grow-mid-iteration.js
new file mode 100644
index 0000000000..efc92706c7
--- /dev/null
+++ b/test/built-ins/Array/prototype/keys/resizable-buffer-grow-mid-iteration.js
@@ -0,0 +1,60 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.keys
+description: >
+  Array.p.keys behaves correctly when receiver is backed by a resizable
+  buffer and is grown mid-iteration
+features: [resizable-arraybuffer]
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+---*/
+
+// Orig. array: [0, 2, 4, 6]
+//              [0, 2, 4, 6] << fixedLength
+//                    [4, 6] << fixedLengthWithOffset
+//              [0, 2, 4, 6, ...] << lengthTracking
+//                    [4, 6, ...] << lengthTrackingWithOffset
+
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLength = new ctor(rab, 0, 4);
+  // The fixed length array is not affected by resizing.
+  TestIterationAndResize(Array.prototype.keys.call(fixedLength), [
+    0,
+    1,
+    2,
+    3
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  // The fixed length array is not affected by resizing.
+  TestIterationAndResize(Array.prototype.keys.call(fixedLengthWithOffset), [
+    0,
+    1
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTracking = new ctor(rab, 0);
+  TestIterationAndResize(Array.prototype.keys.call(lengthTracking), [
+    0,
+    1,
+    2,
+    3,
+    4,
+    5
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+  TestIterationAndResize(Array.prototype.keys.call(lengthTrackingWithOffset), [
+    0,
+    1,
+    2,
+    3
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
diff --git a/test/built-ins/Array/prototype/keys/resizable-buffer-shrink-mid-iteration.js b/test/built-ins/Array/prototype/keys/resizable-buffer-shrink-mid-iteration.js
new file mode 100644
index 0000000000..c432b7309b
--- /dev/null
+++ b/test/built-ins/Array/prototype/keys/resizable-buffer-shrink-mid-iteration.js
@@ -0,0 +1,53 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.keys
+description: >
+  Array.p.keys behaves correctly when receiver is backed by resizable
+  buffer that is shrunk mid-iteration
+features: [resizable-arraybuffer]
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+---*/
+
+// Orig. array: [0, 2, 4, 6]
+//              [0, 2, 4, 6] << fixedLength
+//                    [4, 6] << fixedLengthWithOffset
+//              [0, 2, 4, 6, ...] << lengthTracking
+//                    [4, 6, ...] << lengthTrackingWithOffset
+
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLength = new ctor(rab, 0, 4);
+
+  // The fixed length array goes out of bounds when the RAB is resized.
+  assert.throws(TypeError, () => {
+    TestIterationAndResize(Array.prototype.keys.call(fixedLength), null, rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+  });
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+
+  // The fixed length array goes out of bounds when the RAB is resized.
+  assert.throws(TypeError, () => {
+    TestIterationAndResize(Array.prototype.keys.call(fixedLengthWithOffset), null, rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+  });
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTracking = new ctor(rab, 0);
+  TestIterationAndResize(Array.prototype.keys.call(lengthTracking), [
+    0,
+    1,
+    2
+  ], rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+  TestIterationAndResize(Array.prototype.keys.call(lengthTrackingWithOffset), [
+    0,
+    1
+  ], rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+}
diff --git a/test/built-ins/Array/prototype/keys/resizable-buffer.js b/test/built-ins/Array/prototype/keys/resizable-buffer.js
new file mode 100644
index 0000000000..295ce3612b
--- /dev/null
+++ b/test/built-ins/Array/prototype/keys/resizable-buffer.js
@@ -0,0 +1,142 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.keys
+description: >
+  Array.p.keys behaves correctly when receiver is backed by resizable
+  buffer
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, 2 * i);
+  }
+
+  assert.compareArray(Array.from(Array.prototype.keys.call(fixedLength)), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(Array.from(Array.prototype.keys.call(fixedLengthWithOffset)), [
+    0,
+    1
+  ]);
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTracking)), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTrackingWithOffset)), [
+    0,
+    1
+  ]);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+  // Orig. array: [0, 2, 4]
+  //              [0, 2, 4, ...] << lengthTracking
+  //                    [4, ...] << lengthTrackingWithOffset
+
+  // TypedArray.prototype.{entries, keys, values} throw right away when
+  // called. Array.prototype.{entries, keys, values} don't throw, but when
+  // we try to iterate the returned ArrayIterator, that throws.
+  Array.prototype.keys.call(fixedLength);
+  Array.prototype.keys.call(fixedLengthWithOffset);
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(fixedLength));
+  });
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(fixedLengthWithOffset));
+  });
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTracking)), [
+    0,
+    1,
+    2
+  ]);
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTrackingWithOffset)), [0]);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  Array.prototype.keys.call(fixedLength);
+  Array.prototype.keys.call(fixedLengthWithOffset);
+  Array.prototype.keys.call(lengthTrackingWithOffset);
+
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(fixedLength));
+  });
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(fixedLengthWithOffset));
+  });
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(lengthTrackingWithOffset));
+  });
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTracking)), [0]);
+
+  // Shrink to zero.
+  rab.resize(0);
+  Array.prototype.keys.call(fixedLength);
+  Array.prototype.keys.call(fixedLengthWithOffset);
+  Array.prototype.keys.call(lengthTrackingWithOffset);
+
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(fixedLength));
+  });
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(fixedLengthWithOffset));
+  });
+  assert.throws(TypeError, () => {
+    Array.from(Array.prototype.keys.call(lengthTrackingWithOffset));
+  });
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTracking)), []);
+
+  // Grow so that all TAs are back in-bounds.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  for (let i = 0; i < 6; ++i) {
+    WriteToTypedArray(taWrite, i, 2 * i);
+  }
+
+  // Orig. array: [0, 2, 4, 6, 8, 10]
+  //              [0, 2, 4, 6] << fixedLength
+  //                    [4, 6] << fixedLengthWithOffset
+  //              [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+  //                    [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+
+  assert.compareArray(Array.from(Array.prototype.keys.call(fixedLength)), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(Array.from(Array.prototype.keys.call(fixedLengthWithOffset)), [
+    0,
+    1
+  ]);
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTracking)), [
+    0,
+    1,
+    2,
+    3,
+    4,
+    5
+  ]);
+  assert.compareArray(Array.from(Array.prototype.keys.call(lengthTrackingWithOffset)), [
+    0,
+    1,
+    2,
+    3
+  ]);
+}
diff --git a/test/built-ins/TypedArray/prototype/keys/resizable-buffer-grow-mid-iteration.js b/test/built-ins/TypedArray/prototype/keys/resizable-buffer-grow-mid-iteration.js
new file mode 100644
index 0000000000..fadb221b1c
--- /dev/null
+++ b/test/built-ins/TypedArray/prototype/keys/resizable-buffer-grow-mid-iteration.js
@@ -0,0 +1,60 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.keys
+description: >
+  TypedArray.p.keys behaves correctly when receiver is backed by a resizable
+  buffer and is grown mid-iteration
+features: [resizable-arraybuffer]
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+---*/
+
+// Orig. array: [0, 2, 4, 6]
+//              [0, 2, 4, 6] << fixedLength
+//                    [4, 6] << fixedLengthWithOffset
+//              [0, 2, 4, 6, ...] << lengthTracking
+//                    [4, 6, ...] << lengthTrackingWithOffset
+
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLength = new ctor(rab, 0, 4);
+  // The fixed length array is not affected by resizing.
+  TestIterationAndResize(fixedLength.keys(), [
+    0,
+    1,
+    2,
+    3
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  // The fixed length array is not affected by resizing.
+  TestIterationAndResize(fixedLengthWithOffset.keys(), [
+    0,
+    1
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTracking = new ctor(rab, 0);
+  TestIterationAndResize(lengthTracking.keys(), [
+    0,
+    1,
+    2,
+    3,
+    4,
+    5
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+  TestIterationAndResize(lengthTrackingWithOffset.keys(), [
+    0,
+    1,
+    2,
+    3
+  ], rab, 2, 6 * ctor.BYTES_PER_ELEMENT);
+}
diff --git a/test/built-ins/TypedArray/prototype/keys/resizable-buffer-shrink-mid-iteration.js b/test/built-ins/TypedArray/prototype/keys/resizable-buffer-shrink-mid-iteration.js
new file mode 100644
index 0000000000..86f03483d0
--- /dev/null
+++ b/test/built-ins/TypedArray/prototype/keys/resizable-buffer-shrink-mid-iteration.js
@@ -0,0 +1,53 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.keys
+description: >
+  TypedArray.p.keys behaves correctly when receiver is backed by resizable
+  buffer that is shrunk mid-iteration
+features: [resizable-arraybuffer]
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+---*/
+
+// Orig. array: [0, 2, 4, 6]
+//              [0, 2, 4, 6] << fixedLength
+//                    [4, 6] << fixedLengthWithOffset
+//              [0, 2, 4, 6, ...] << lengthTracking
+//                    [4, 6, ...] << lengthTrackingWithOffset
+
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLength = new ctor(rab, 0, 4);
+
+  // The fixed length array goes out of bounds when the RAB is resized.
+  assert.throws(TypeError, () => {
+    TestIterationAndResize(fixedLength.keys(), null, rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+  });
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+
+  // The fixed length array goes out of bounds when the RAB is resized.
+  assert.throws(TypeError, () => {
+    TestIterationAndResize(fixedLengthWithOffset.keys(), null, rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+  });
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTracking = new ctor(rab, 0);
+  TestIterationAndResize(lengthTracking.keys(), [
+    0,
+    1,
+    2
+  ], rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+}
+for (let ctor of ctors) {
+  const rab = CreateRabForTest(ctor);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+  TestIterationAndResize(lengthTrackingWithOffset.keys(), [
+    0,
+    1
+  ], rab, 2, 3 * ctor.BYTES_PER_ELEMENT);
+}
diff --git a/test/built-ins/TypedArray/prototype/keys/resizable-buffer.js b/test/built-ins/TypedArray/prototype/keys/resizable-buffer.js
new file mode 100644
index 0000000000..694087c7e8
--- /dev/null
+++ b/test/built-ins/TypedArray/prototype/keys/resizable-buffer.js
@@ -0,0 +1,141 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-%typedarray%.prototype.keys
+description: >
+  TypedArray.p.keys behaves correctly when receiver is backed by resizable
+  buffer
+includes: [compareArray.js, resizableArrayBufferUtils.js]
+features: [resizable-arraybuffer]
+---*/
+
+for (let ctor of ctors) {
+  const rab = CreateResizableArrayBuffer(4 * ctor.BYTES_PER_ELEMENT, 8 * ctor.BYTES_PER_ELEMENT);
+  const fixedLength = new ctor(rab, 0, 4);
+  const fixedLengthWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT, 2);
+  const lengthTracking = new ctor(rab, 0);
+  const lengthTrackingWithOffset = new ctor(rab, 2 * ctor.BYTES_PER_ELEMENT);
+
+  // Write some data into the array.
+  const taWrite = new ctor(rab);
+  for (let i = 0; i < 4; ++i) {
+    WriteToTypedArray(taWrite, i, 2 * i);
+  }
+
+  // Orig. array: [0, 2, 4, 6]
+  //              [0, 2, 4, 6] << fixedLength
+  //                    [4, 6] << fixedLengthWithOffset
+  //              [0, 2, 4, 6, ...] << lengthTracking
+  //                    [4, 6, ...] << lengthTrackingWithOffset
+
+  assert.compareArray(Array.from(fixedLength.keys()), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(Array.from(fixedLengthWithOffset.keys()), [
+    0,
+    1
+  ]);
+  assert.compareArray(Array.from(lengthTracking.keys()), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(Array.from(lengthTrackingWithOffset.keys()), [
+    0,
+    1
+  ]);
+
+  // Shrink so that fixed length TAs go out of bounds.
+  rab.resize(3 * ctor.BYTES_PER_ELEMENT);
+
+  // Orig. array: [0, 2, 4]
+  //              [0, 2, 4, ...] << lengthTracking
+  //                    [4, ...] << lengthTrackingWithOffset
+
+  // TypedArray.prototype.{entries, keys, values} throw right away when
+  // called. Array.prototype.{entries, keys, values} don't throw, but when
+  // we try to iterate the returned ArrayIterator, that throws.
+  assert.throws(TypeError, () => {
+    fixedLength.keys();
+  });
+  assert.throws(TypeError, () => {
+    fixedLengthWithOffset.keys();
+  });
+
+  assert.compareArray(Array.from(lengthTracking.keys()), [
+    0,
+    1,
+    2
+  ]);
+  assert.compareArray(Array.from(lengthTrackingWithOffset.keys()), [0]);
+
+  // Shrink so that the TAs with offset go out of bounds.
+  rab.resize(1 * ctor.BYTES_PER_ELEMENT);
+  assert.throws(TypeError, () => {
+    fixedLength.keys();
+  });
+  assert.throws(TypeError, () => {
+    fixedLengthWithOffset.keys();
+  });
+  assert.throws(TypeError, () => {
+    lengthTrackingWithOffset.keys();
+  });
+
+  assert.compareArray(Array.from(lengthTracking.keys()), [0]);
+
+  // Shrink to zero.
+  rab.resize(0);
+  assert.throws(TypeError, () => {
+    fixedLength.keys();
+  });
+  assert.throws(TypeError, () => {
+    fixedLengthWithOffset.keys();
+  });
+  assert.throws(TypeError, () => {
+    lengthTrackingWithOffset.keys();
+  });
+
+  assert.compareArray(Array.from(lengthTracking.keys()), []);
+
+  // Grow so that all TAs are back in-bounds.
+  rab.resize(6 * ctor.BYTES_PER_ELEMENT);
+  for (let i = 0; i < 6; ++i) {
+    WriteToTypedArray(taWrite, i, 2 * i);
+  }
+
+  // Orig. array: [0, 2, 4, 6, 8, 10]
+  //              [0, 2, 4, 6] << fixedLength
+  //                    [4, 6] << fixedLengthWithOffset
+  //              [0, 2, 4, 6, 8, 10, ...] << lengthTracking
+  //                    [4, 6, 8, 10, ...] << lengthTrackingWithOffset
+
+  assert.compareArray(Array.from(fixedLength.keys()), [
+    0,
+    1,
+    2,
+    3
+  ]);
+  assert.compareArray(Array.from(fixedLengthWithOffset.keys()), [
+    0,
+    1
+  ]);
+  assert.compareArray(Array.from(lengthTracking.keys()), [
+    0,
+    1,
+    2,
+    3,
+    4,
+    5
+  ]);
+  assert.compareArray(Array.from(lengthTrackingWithOffset.keys()), [
+    0,
+    1,
+    2,
+    3
+  ]);
+}