--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/WebCore/manual-tests/property-map-save-crash.html Fri Sep 17 09:02:29 2010 +0300
@@ -0,0 +1,49 @@
+<html>
+ <head>
+ <script>
+ function test()
+ {
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ window.crash = "crash";
+ delete window.crash;
+
+ if (window.navigationController)
+ navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
+ }
+
+ function continueTestAfterNavigation()
+ {
+ print("PASS: You didn't crash");
+
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }
+
+ function print(message) {
+ var paragraph = document.createElement("p");
+ paragraph.appendChild(document.createTextNode(message));
+ document.getElementById("console").appendChild(paragraph);
+ }
+ </script>
+ </head>
+
+ <body onload="test()">
+ <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p>
+ <p>This cause for this bug was that the code to save the window object's property map tried to use
+ the deleted property sentinel key as a normal pointer.</p>
+ <p>To run this test in Safari:</p>
+ <ol>
+ <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
+ <li>You should not crash.</li>
+ </ol>
+ <p>When the automated version of this test passes, you'll see a PASS message below.
+ (The automated version is currently disabled because DumpRenderTree doesn't work
+ with the back/forward cache enabled.)</p>
+ <hr>
+ <div id="console"></div>
+ </body>
+</html>