50 lines
1.9 KiB
HTML
50 lines
1.9 KiB
HTML
<html>
|
|
<head>
|
|
<script>
|
|
function test()
|
|
{
|
|
if (window.layoutTestController) {
|
|
layoutTestController.dumpAsText();
|
|
layoutTestController.waitUntilDone();
|
|
}
|
|
|
|
window.crash = "crash";
|
|
delete window.crash;
|
|
|
|
if (window.navigationController)
|
|
navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
|
|
}
|
|
|
|
function continueTestAfterNavigation()
|
|
{
|
|
print("PASS: You didn't crash");
|
|
|
|
if (window.layoutTestController)
|
|
layoutTestController.notifyDone();
|
|
}
|
|
|
|
function print(message) {
|
|
var paragraph = document.createElement("p");
|
|
paragraph.appendChild(document.createTextNode(message));
|
|
document.getElementById("console").appendChild(paragraph);
|
|
}
|
|
</script>
|
|
</head>
|
|
|
|
<body onload="test()">
|
|
<p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p>
|
|
<p>This cause for this bug was that the code to save the window object's property map tried to use
|
|
the deleted property sentinel key as a normal pointer.</p>
|
|
<p>To run this test in Safari:</p>
|
|
<ol>
|
|
<li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
|
|
<li>You should not crash.</li>
|
|
</ol>
|
|
<p>When the automated version of this test passes, you'll see a PASS message below.
|
|
(The automated version is currently disabled because DumpRenderTree doesn't work
|
|
with the back/forward cache enabled.)</p>
|
|
<hr>
|
|
<div id="console"></div>
|
|
</body>
|
|
</html>
|