equal
deleted
inserted
replaced
|
1 <html> |
|
2 <head> |
|
3 <script> |
|
4 function test() |
|
5 { |
|
6 if (window.layoutTestController) { |
|
7 layoutTestController.dumpAsText(); |
|
8 layoutTestController.waitUntilDone(); |
|
9 } |
|
10 |
|
11 window.crash = "crash"; |
|
12 delete window.crash; |
|
13 |
|
14 if (window.navigationController) |
|
15 navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()"); |
|
16 } |
|
17 |
|
18 function continueTestAfterNavigation() |
|
19 { |
|
20 print("PASS: You didn't crash"); |
|
21 |
|
22 if (window.layoutTestController) |
|
23 layoutTestController.notifyDone(); |
|
24 } |
|
25 |
|
26 function print(message) { |
|
27 var paragraph = document.createElement("p"); |
|
28 paragraph.appendChild(document.createTextNode(message)); |
|
29 document.getElementById("console").appendChild(paragraph); |
|
30 } |
|
31 </script> |
|
32 </head> |
|
33 |
|
34 <body onload="test()"> |
|
35 <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> |
|
36 <p>This cause for this bug was that the code to save the window object's property map tried to use |
|
37 the deleted property sentinel key as a normal pointer.</p> |
|
38 <p>To run this test in Safari:</p> |
|
39 <ol> |
|
40 <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li> |
|
41 <li>You should not crash.</li> |
|
42 </ol> |
|
43 <p>When the automated version of this test passes, you'll see a PASS message below. |
|
44 (The automated version is currently disabled because DumpRenderTree doesn't work |
|
45 with the back/forward cache enabled.)</p> |
|
46 <hr> |
|
47 <div id="console"></div> |
|
48 </body> |
|
49 </html> |