property-map-save-crash.html - Android社区 - https://www.androidos.net.cn/

<html>
    <head>
        <script>
            function test()
            {
                if (window.layoutTestController) {
                    layoutTestController.dumpAsText();
                    layoutTestController.waitUntilDone();
                }
                
                window.crash = "crash";
                delete window.crash;
                    
                if (window.navigationController)
                    navigationController.evalAfterBackForwardNavigation("continueTestAfterNavigation()");
            }
            
            function continueTestAfterNavigation()
            {
                print("PASS: You didn't crash");
                
                if (window.layoutTestController)
                    layoutTestController.notifyDone();
            }

            function print(message) {
                var paragraph = document.createElement("p");
                paragraph.appendChild(document.createTextNode(message));
                document.getElementById("console").appendChild(paragraph);
            }
        </script>
    </head>

    <body onload="test()">
        <p>Bug: rdar://problem/4465598 REGRESSION (TOT): Crash occurs at http://maps.google.com/?output=html ( KJS::Identifier::add(KJS::UString::Rep*)</p> 
        <p>This cause for this bug was that the code to save the window object's property map tried to use
        the deleted property sentinel key as a normal pointer.</p>
        <p>To run this test in Safari:</p>
        <ol>
            <li><a href="resources/go-back.html">Click here to do a back/forward navigation.</a></li>
            <li>You should not crash.</li>
        </ol>
        <p>When the automated version of this test passes, you'll see a PASS message below.
        (The automated version is currently disabled because DumpRenderTree doesn't work
        with the back/forward cache enabled.)</p>
        <hr>
        <div id="console"></div>
    </body>
</html>