bug1488163.js (498B)
1 async function f() { 2 // Enough variables that SM will eventually decide to create a lookup table 3 // for this scope. 4 var q0, q1, q2, q3, q4, q5, q6, q7, q8, q9; 5 } 6 7 var g = newGlobal({newCompartment: true}); 8 g.parent = this; 9 g.eval(` 10 var dbg = new Debugger(parent); 11 dbg.onEnterFrame = frame => {}; 12 `); 13 14 // Fragile: Trigger Shape::hashify() for the shape of the environment in f 15 // under a call to GetGeneratorObjectForFrame from the Debugger. 16 for (let i = 0; i < 3; i++) 17 f();