1<html> 2 <head> 3 <script> 4 function test() 5 { 6 if (window.layoutTestController) { 7 layoutTestController.dumpAsText(); 8 layoutTestController.waitUntilDone(); 9 } 10 11 window.crash = "crash"; 12 delete window.crash; 13 14 if (window.navigationController) 15 navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()"); 16 } 17 18 function continueTestAfterNavigation() 19 { 20 print("PASS: You didn't crash"); 21 22 if (window.layoutTestController) 23 layoutTestController.notifyDone(); 24 } 25 26 function print(message) { 27 var paragraph = document.createElement("p"); 28 paragraph.appendChild(document.createTextNode(message)); 29 document.getElementById("console").appendChild(paragraph); 30 } 31 </script> 32 </head> 33 34 <body onload="test()"> 35 <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> 36 <p>This cause for this bug was that the code to save the window object's property map tried to use 37 the deleted property sentinel key as a normal pointer.</p> 38 <p>To run this test in Safari:</p> 39 <ol> 40 <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li> 41 <li>You should not crash.</li> 42 </ol> 43 <p>When the automated version of this test passes, you'll see a PASS message below. 44 (The automated version is currently disabled because DumpRenderTree doesn't work 45 with the back/forward cache enabled.)</p> 46 <hr> 47 <div id="console"></div> 48 </body> 49</html> 50