1 files changed, 42 insertions, 0 deletions
diff --git a/testing/web-platform/tests/resource-timing/object-not-found-after-cross-origin-redirect.html b/testing/web-platform/tests/resource-timing/object-not-found-after-cross-origin-redirect.html
new file mode 100644
index 0000000000..6990c6c060
--- /dev/null
+++ b/testing/web-platform/tests/resource-timing/object-not-found-after-cross-origin-redirect.html
@@ -0,0 +1,42 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8" />
+<title>This test validates the values in resource timing for cross-origin
+redirects.</title>
+<meta name="timeout" content="long">
+<link rel="author" title="Noam Rosenthal" href="noam@webkit.org">
+<link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-performanceresourcetiming"/>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<script src="resources/resource-loaders.js"></script>
+<script src="resources/entry-invariants.js"></script>
+</head>
+<body>
+<script>
+const {REMOTE_ORIGIN} = get_host_info();
+const delay = 1;
+const not_found_page = encodeURIComponent("/resource-timing/resources/status-code.py?status=404");
+const load_null_object = async path => {
+  return load.object(path, null);
+}
+const destUrl = `/common/slow-redirect.py?delay=${delay}&location=${REMOTE_ORIGIN}${not_found_page}`;
+
+const timeBefore = performance.now();
+(async () => {
+  // Wait 10 ms, to ensure the difference between startTime and timeBefore is
+  // larger than 1 ms, to avoid flakiness in browsers that clamp timestamps to
+  // 1 ms.
+  await new Promise(r => step_timeout(r, 10));
+  attribute_test(load_null_object, destUrl, entry => {
+      assert_equals(entry.startTime, entry.fetchStart, 'startTime and fetchStart should be equal');
+      assert_greater_than(entry.startTime, timeBefore, 'startTime and fetchStart should be greater than the time before fetching');
+      // See https://github.com/w3c/resource-timing/issues/264
+      assert_less_than(Math.round(entry.startTime - timeBefore), delay * 1000, 'startTime should not expose redirect delays');
+  }, "Verify that cross-origin object resources don't implicitly expose their redirect timings")
+})();
+
+</script>
+</body>
+</html>