Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

50 lines (43 sloc) 1.968 kb
<html>
<head>
<script>
function test()
{
if (window.layoutTestController) {
layoutTestController.dumpAsText();
layoutTestController.waitUntilDone();
}
window.crash = "crash";
delete window.crash;
if (window.navigationController)
navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
}
function continueTestAfterNavigation()
{
print("PASS: You didn't crash");
if (window.layoutTestController)
layoutTestController.notifyDone();
}
function print(message) {
var paragraph = document.createElement("p");
paragraph.appendChild(document.createTextNode(message));
document.getElementById("console").appendChild(paragraph);
}
</script>
</head>
<body onload="test()">
<p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p>
<p>This cause for this bug was that the code to save the window object's property map tried to use
the deleted property sentinel key as a normal pointer.</p>
<p>To run this test in Safari:</p>
<ol>
<li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
<li>You should not crash.</li>
</ol>
<p>When the automated version of this test passes, you'll see a PASS message below.
(The automated version is currently disabled because DumpRenderTree doesn't work
with the back/forward cache enabled.)</p>
<hr>
<div id="console"></div>
</body>
</html>
Jump to Line
Something went wrong with that request. Please try again.