src/third_party/mozjs-45/js/src/jit-test/tests/gc/bug-1218900.js

// |jit-test| --fuzzing-safe
readline = function() {};
Function.prototype.toString = function() {
    for (var i = 0; i < 2; i++) {
        this()
    }
};
getBacktrace({thisprops: true});