blob: c4dce1a0a156a25d3807a712f4deddf56891f2a4 [file] [log] [blame]
<html>
<head>
<script>
function test()
{
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
window.crash = "crash";
delete window.crash;
if (window.navigationController)
navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
}
function continueTestAfterNavigation()
{
print("PASS: You didn't crash");
if (window.layoutTestController)
layoutTestController.notifyDone();
}
function print(message) {
var paragraph = document.createElement("p");
paragraph.appendChild(document.createTextNode(message));
document.getElementById("console").appendChild(paragraph);
}
</script>
</head>
<body onload="test()">
<p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p>
<p>This cause for this bug was that the code to save the window object's property map tried to use
the deleted property sentinel key as a normal pointer.</p>
<p>To run this test in Safari:</p>
<ol>
<li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
<li>You should not crash.</li>
</ol>
<p>When the automated version of this test passes, you'll see a PASS message below.
(The automated version is currently disabled because DumpRenderTree doesn't work
with the back/forward cache enabled.)</p>
<hr>
<div id="console"></div>
</body>
</html>