diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-28 14:29:10 +0000 |
| commit | 2aa4a82499d4becd2284cdb482213d541b8804dd (patch) | |
| tree | b80bf8bf13c3766139fbacc530efd0dd9d54394c /dom/plugins/test/crashtests/598862.html | |
| parent | Initial commit. (diff) | |
| download | firefox-upstream.tar.xz firefox-upstream.zip | |
Adding upstream version 86.0.1.upstream/86.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
| -rw-r--r-- | dom/plugins/test/crashtests/598862.html | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/dom/plugins/test/crashtests/598862.html b/dom/plugins/test/crashtests/598862.html new file mode 100644 index 0000000000..02ffb05428 --- /dev/null +++ b/dom/plugins/test/crashtests/598862.html @@ -0,0 +1,77 @@ +<!DOCTYPE HTML> +<html class="reftest-wait"> + <head> + <script> +var unusedScreenX; +function XSync() { + unusedScreenX = window.screenX; +} + +function finish() { + document.documentElement.removeAttribute("class"); +} + +function cleanup() { + try { + document.getElementById("plugin").crash(); + } catch (dontcare) { + } + window.setTimeout(finish, 100); +} + +function scrollOfDeath() { + // Add a listener for the MozAfterPaint after the scrollTo below. + // If we don't crash during the scroll, we'll get the + // MozAfterPaint. + window.addEventListener("MozAfterPaint", cleanup); + window.scrollTo(0, 50); +} + +// +// The sequence of events we expect is +// +// load (including initial paints of plugin that are cached) +// destroy X resources +// [X server has time to observe resource destruction] +// scrollTo +// [repaint using cached plugin surface: BOOM if buggy] +// MozAfterPaint +// cleanup +// +// However, this test is fundamentally nondeterministic. There are +// two main "failure" modes +// (1) X server doesn't have time to observer resource destruction +// before paint-after-scroll +// (2) plugin's crash notification arrives before +// paint-after-scroll +// Both result in spurious passes. +// +// This test is anal about cleanup because it must be pretty sure that +// the plugin subprocess is gone before starting the next test. We +// double-check that the plugin is gone by the time we're done by +// trying to crash it again, after we expect it to have crashed already. +// +function runTest() { + // Have the plugin throw away its X resources, one of which is + // probably a drawable to which we hold a reference + document.getElementById("plugin").destroySharedGfxStuff(); + + // Do something that's (hopefully) equivalent to an XSync() to allow + // the resource destruction to propagate to the server + XSync(); + + // Set up a scroll to happen soon + window.setTimeout(scrollOfDeath, 100); +} + +window.addEventListener("MozReftestInvalidate", runTest); + </script> + </head> + + <body style="width: 400px; height: 10000px;"> + <embed id="plugin" type="application/x-test" + style="position:absolute; + top:100px; left:50px; width:200px; height:200px;"> + </embed> + </body> +</html> |