It's not exactly variables. The Bugzilla entry is more specific: "... entails copying all the values that are currently on the interpreter's stack (arguments, local variables, intermediate results) from the heap onto the native stack." https://bugzilla.mozilla.org/show_bug.cgi?id=1839139#c8
So it may be a large function with lots of temporary values visible in scope. If I understand correctly, local lambdas would also count and they have their own captured context. I'm sure it's possible to find a pathological-but-not-unreasonable way to reproduce it.
I wrote that comment. One other possibility: if you use spread syntax to call a function with a large array (eg `foo(...Array(20000))`), then all those arguments will be pushed on the stack.
(I didn't dig into the specifics of the Google code because, as weird as it is to have 20000 stack values, we really should be able to handle it. This was, at the end of the day, a bug in our stack probing code.)
I don't know for sure, but it sounds like the result of a JS obfuscater. I know Google Docs ships obfuscated code so I wouldn't be surprised if Google Image Search does too.
