blob: c4dce1a0a156a25d3807a712f4deddf56891f2a4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
<html>
<head>
<script>
function test()
{
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
window.crash = "crash";
delete window.crash;
if (window.navigationController)
navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
}
function continueTestAfterNavigation()
{
print("PASS: You didn't crash");
if (window.layoutTestController)
layoutTestController.notifyDone();
}
function print(message) {
var paragraph = document.createElement("p");
paragraph.appendChild(document.createTextNode(message));
document.getElementById("console").appendChild(paragraph);
}
</script>
</head>
<body onload="test()">
<p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p>
<p>This cause for this bug was that the code to save the window object's property map tried to use
the deleted property sentinel key as a normal pointer.</p>
<p>To run this test in Safari:</p>
<ol>
<li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
<li>You should not crash.</li>
</ol>
<p>When the automated version of this test passes, you'll see a PASS message below.
(The automated version is currently disabled because DumpRenderTree doesn't work
with the back/forward cache enabled.)</p>
<hr>
<div id="console"></div>
</body>
</html>
|
