js/src/jit-test/tests/gc/bug-1218900.js


1
2
3
4
5
6
7
8

// |jit-test| --fuzzing-safe
readline = function() {};
Function.prototype.toString = function() {
    for (var i = 0; i < 2; i++) {
        this()
    }
};
getBacktrace({thisprops: true});