third_party/WebKit/ManualTests/property-map-save-crash.html

   1 <html>
   2     <head>
   3         <script>
   4             function test()
   5             {
   6                 if (window.layoutTestController) {
   7                     layoutTestController.dumpAsText();
   8                     layoutTestController.waitUntilDone();
   9                 }
  10
  11                 window.crash = "crash";
  12                 delete window.crash;
  13
  14                 if (window.navigationController)
  15                     navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
  16             }
  17
  18             function continueTestAfterNavigation()
  19             {
  20                 print("PASS: You didn't crash");
  21
  22                 if (window.layoutTestController)
  23                     layoutTestController.notifyDone();
  24             }
  25
  26             function print(message) {
  27                 var paragraph = document.createElement("p");
  28                 paragraph.appendChild(document.createTextNode(message));
  29                 document.getElementById("console").appendChild(paragraph);
  30             }
  31         </script>
  32     </head>
  33
  34     <body onload="test()">
  35         <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p>
  36         <p>This cause for this bug was that the code to save the window object's property map tried to use
  37         the deleted property sentinel key as a normal pointer.</p>
  38         <p>To run this test in Safari:</p>
  39         <ol>
  40             <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
  41             <li>You should not crash.</li>
  42         </ol>
  43         <p>When the automated version of this test passes, you'll see a PASS message below.
  44         (The automated version is currently disabled because DumpRenderTree doesn't work
  45         with the back/forward cache enabled.)</p>
  46         <hr>
  47         <div id="console"></div>
  48     </body>
  49 </html>