diff options
| author | The Android Open Source Project <initial-contribution@android.com> | 2009-03-03 19:30:52 -0800 |
|---|---|---|
| committer | The Android Open Source Project <initial-contribution@android.com> | 2009-03-03 19:30:52 -0800 |
| commit | 8e35f3cfc7fba1d1c829dc557ebad6409cbe16a2 (patch) | |
| tree | 11425ea0b299d6fb89c6d3618a22d97d5bf68d0f /WebCore/manual-tests/property-map-save-crash.html | |
| parent | 648161bb0edfc3d43db63caed5cc5213bc6cb78f (diff) | |
| download | external_webkit-8e35f3cfc7fba1d1c829dc557ebad6409cbe16a2.zip external_webkit-8e35f3cfc7fba1d1c829dc557ebad6409cbe16a2.tar.gz external_webkit-8e35f3cfc7fba1d1c829dc557ebad6409cbe16a2.tar.bz2 | |
auto import from //depot/cupcake/@135843
Diffstat (limited to 'WebCore/manual-tests/property-map-save-crash.html')
| -rw-r--r-- | WebCore/manual-tests/property-map-save-crash.html | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/WebCore/manual-tests/property-map-save-crash.html b/WebCore/manual-tests/property-map-save-crash.html new file mode 100644 index 0000000..c4dce1a --- /dev/null +++ b/WebCore/manual-tests/property-map-save-crash.html @@ -0,0 +1,49 @@ +<html> + <head> + <script> + function test() + { + if (window.layoutTestController) { + layoutTestController.dumpAsText(); + layoutTestController.waitUntilDone(); + } + + window.crash = "crash"; + delete window.crash; + + if (window.navigationController) + navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()"); + } + + function continueTestAfterNavigation() + { + print("PASS: You didn't crash"); + + if (window.layoutTestController) + layoutTestController.notifyDone(); + } + + function print(message) { + var paragraph = document.createElement("p"); + paragraph.appendChild(document.createTextNode(message)); + document.getElementById("console").appendChild(paragraph); + } + </script> + </head> + + <body onload="test()"> + <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> + <p>This cause for this bug was that the code to save the window object's property map tried to use + the deleted property sentinel key as a normal pointer.</p> + <p>To run this test in Safari:</p> + <ol> + <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li> + <li>You should not crash.</li> + </ol> + <p>When the automated version of this test passes, you'll see a PASS message below. + (The automated version is currently disabled because DumpRenderTree doesn't work + with the back/forward cache enabled.)</p> + <hr> + <div id="console"></div> + </body> +</html> |