1 files changed, 49 insertions, 0 deletions
diff --git a/Source/WebCore/manual-tests/property-map-save-crash.html b/Source/WebCore/manual-tests/property-map-save-crash.html
new file mode 100644
index 0000000..c4dce1a
--- /dev/null
+++ b/Source/WebCore/manual-tests/property-map-save-crash.html
@@ -0,0 +1,49 @@
+<html>
+    <head>
+        <script>
+            function test()
+            {
+                if (window.layoutTestController) {
+                    layoutTestController.dumpAsText();
+                    layoutTestController.waitUntilDone();
+                }
+                
+                window.crash = "crash";
+                delete window.crash;
+                    
+                if (window.navigationController)
+                    navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
+            }
+            
+            function continueTestAfterNavigation()
+            {
+                print("PASS: You didn't crash");
+                
+                if (window.layoutTestController)
+                    layoutTestController.notifyDone();
+            }
+
+            function print(message) {
+                var paragraph = document.createElement("p");
+                paragraph.appendChild(document.createTextNode(message));
+                document.getElementById("console").appendChild(paragraph);
+            }
+        </script>
+    </head>
+
+    <body onload="test()">
+        <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> 
+        <p>This cause for this bug was that the code to save the window object's property map tried to use
+        the deleted property sentinel key as a normal pointer.</p>
+        <p>To run this test in Safari:</p>
+        <ol>
+            <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
+            <li>You should not crash.</li>
+        </ol>
+        <p>When the automated version of this test passes, you'll see a PASS message below.
+        (The automated version is currently disabled because DumpRenderTree doesn't work
+        with the back/forward cache enabled.)</p>
+        <hr>
+        <div id="console"></div>
+    </body>
+</html>