diff options
Diffstat (limited to 'WebCore/manual-tests/property-map-save-crash.html')
-rw-r--r-- | WebCore/manual-tests/property-map-save-crash.html | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/WebCore/manual-tests/property-map-save-crash.html b/WebCore/manual-tests/property-map-save-crash.html new file mode 100644 index 0000000..c4dce1a --- /dev/null +++ b/WebCore/manual-tests/property-map-save-crash.html @@ -0,0 +1,49 @@ +<html> + <head> + <script> + function test() + { + if (window.layoutTestController) { + layoutTestController.dumpAsText(); + layoutTestController.waitUntilDone(); + } + + window.crash = "crash"; + delete window.crash; + + if (window.navigationController) + navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()"); + } + + function continueTestAfterNavigation() + { + print("PASS: You didn't crash"); + + if (window.layoutTestController) + layoutTestController.notifyDone(); + } + + function print(message) { + var paragraph = document.createElement("p"); + paragraph.appendChild(document.createTextNode(message)); + document.getElementById("console").appendChild(paragraph); + } + </script> + </head> + + <body onload="test()"> + <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> + <p>This cause for this bug was that the code to save the window object's property map tried to use + the deleted property sentinel key as a normal pointer.</p> + <p>To run this test in Safari:</p> + <ol> + <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li> + <li>You should not crash.</li> + </ol> + <p>When the automated version of this test passes, you'll see a PASS message below. + (The automated version is currently disabled because DumpRenderTree doesn't work + with the back/forward cache enabled.)</p> + <hr> + <div id="console"></div> + </body> +</html> |