--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/WebCore/manual-tests/clearTimeout-crash-bug29832.html Fri Sep 17 09:02:29 2010 +0300
@@ -0,0 +1,20 @@
+<script>
+var w;
+function clear() {
+ w.clearTimeout(153);
+}
+
+function test() {
+ w = window.open("data:text/html,"+
+ "<script>" +
+ "function navigate() { location.href='data:text/html,<body>Close this page and wait.</body>'};" +
+ "setTimeout(navigate,0);</" +
+ "script>");
+
+ setInterval(clear, 0);
+}
+</script>
+<body>
+<p>This test reproduces the crash in DOMWindow::clearTimeout that happens when DOMWindow is disconnected from the Frame (as in back/forward cache expiration case tested here).
+<p>This is the link to the bug: <a href="https://bugs.webkit.org/show_bug.cgi?id=29832">https://bugs.webkit.org/show_bug.cgi?id=29832</a>
+<p>To reproduce the crash, click the link below, the popup window opens, which will immediately navigate to another one, so the b/f cache entry will be created. Close the popup window. Wait a few seconds (~10), for the page cache to start deleting pages it doesn't need - crash will happen.<br><a href="javascript:test()">Crash me!</a>