| Torne (Richard Coles) | 5c87bf8 | 2012-11-14 11:46:17 +0000 | [diff] [blame] | 1 | <html> |
| 2 | <head> |
| 3 | <script> |
| 4 | function test() |
| 5 | { |
| 6 | if (window.layoutTestController) { |
| 7 | layoutTestController.dumpAsText(); |
| 8 | layoutTestController.waitUntilDone(); |
| 9 | } |
| 10 | |
| 11 | window.crash = "crash"; |
| 12 | delete window.crash; |
| 13 | |
| 14 | if (window.navigationController) |
| 15 | navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()"); |
| 16 | } |
| 17 | |
| 18 | function continueTestAfterNavigation() |
| 19 | { |
| 20 | print("PASS: You didn't crash"); |
| 21 | |
| 22 | if (window.layoutTestController) |
| 23 | layoutTestController.notifyDone(); |
| 24 | } |
| 25 | |
| 26 | function print(message) { |
| 27 | var paragraph = document.createElement("p"); |
| 28 | paragraph.appendChild(document.createTextNode(message)); |
| 29 | document.getElementById("console").appendChild(paragraph); |
| 30 | } |
| 31 | </script> |
| 32 | </head> |
| 33 | |
| 34 | <body onload="test()"> |
| 35 | <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> |
| 36 | <p>This cause for this bug was that the code to save the window object's property map tried to use |
| 37 | the deleted property sentinel key as a normal pointer.</p> |
| 38 | <p>To run this test in Safari:</p> |
| 39 | <ol> |
| 40 | <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li> |
| 41 | <li>You should not crash.</li> |
| 42 | </ol> |
| 43 | <p>When the automated version of this test passes, you'll see a PASS message below. |
| 44 | (The automated version is currently disabled because DumpRenderTree doesn't work |
| 45 | with the back/forward cache enabled.)</p> |
| 46 | <hr> |
| 47 | <div id="console"></div> |
| 48 | </body> |
| 49 | </html> |