| <html> |
| <head> |
| <script> |
| function test() |
| { |
| if (window.layoutTestController) { |
| layoutTestController.dumpAsText(); |
| layoutTestController.waitUntilDone(); |
| } |
| |
| window.crash = "crash"; |
| delete window.crash; |
| |
| if (window.navigationController) |
| navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()"); |
| } |
| |
| function continueTestAfterNavigation() |
| { |
| print("PASS: You didn't crash"); |
| |
| if (window.layoutTestController) |
| layoutTestController.notifyDone(); |
| } |
| |
| function print(message) { |
| var paragraph = document.createElement("p"); |
| paragraph.appendChild(document.createTextNode(message)); |
| document.getElementById("console").appendChild(paragraph); |
| } |
| </script> |
| </head> |
| |
| <body onload="test()"> |
| <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> |
| <p>This cause for this bug was that the code to save the window object's property map tried to use |
| the deleted property sentinel key as a normal pointer.</p> |
| <p>To run this test in Safari:</p> |
| <ol> |
| <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li> |
| <li>You should not crash.</li> |
| </ol> |
| <p>When the automated version of this test passes, you'll see a PASS message below. |
| (The automated version is currently disabled because DumpRenderTree doesn't work |
| with the back/forward cache enabled.)</p> |
| <hr> |
| <div id="console"></div> |
| </body> |
| </html> |
