diff -r 000000000000 -r 4f2f89ce4247 WebCore/manual-tests/property-map-save-crash.html --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/WebCore/manual-tests/property-map-save-crash.html Fri Sep 17 09:02:29 2010 +0300 @@ -0,0 +1,49 @@ + + + + + + +

Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)

+

This cause for this bug was that the code to save the window object's property map tried to use + the deleted property sentinel key as a normal pointer.

+

To run this test in Safari:

+
    +
  1. Click here to do a back/forward navigation.
    2. +
  2. You should not crash.
    3. +
+

When the automated version of this test passes, you'll see a PASS message below. + (The automated version is currently disabled because DumpRenderTree doesn't work + with the back/forward cache enabled.)

+
+
+ +