1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/dom/plugins/test/crashtests/598862.html Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,77 @@
1.4 +<!DOCTYPE HTML>
1.5 +<html class="reftest-wait">
1.6 + <head>
1.7 + <script>
1.8 +var unusedScreenX;
1.9 +function XSync() {
1.10 + unusedScreenX = window.screenX;
1.11 +}
1.12 +
1.13 +function finish() {
1.14 + document.documentElement.removeAttribute("class");
1.15 +}
1.16 +
1.17 +function cleanup() {
1.18 + try {
1.19 + document.getElementById("plugin").crash();
1.20 + } catch (dontcare) {
1.21 + }
1.22 + window.setTimeout(finish, 100);
1.23 +}
1.24 +
1.25 +function scrollOfDeath() {
1.26 + // Add a listener for the MozAfterPaint after the scrollTo below.
1.27 + // If we don't crash during the scroll, we'll get the
1.28 + // MozAfterPaint.
1.29 + window.addEventListener("MozAfterPaint", cleanup, false);
1.30 + window.scrollTo(0, 50);
1.31 +}
1.32 +
1.33 +//
1.34 +// The sequence of events we expect is
1.35 +//
1.36 +// load (including initial paints of plugin that are cached)
1.37 +// destroy X resources
1.38 +// [X server has time to observe resource destruction]
1.39 +// scrollTo
1.40 +// [repaint using cached plugin surface: BOOM if buggy]
1.41 +// MozAfterPaint
1.42 +// cleanup
1.43 +//
1.44 +// However, this test is fundamentally nondeterministic. There are
1.45 +// two main "failure" modes
1.46 +// (1) X server doesn't have time to observer resource destruction
1.47 +// before paint-after-scroll
1.48 +// (2) plugin's crash notification arrives before
1.49 +// paint-after-scroll
1.50 +// Both result in spurious passes.
1.51 +//
1.52 +// This test is anal about cleanup because it must be pretty sure that
1.53 +// the plugin subprocess is gone before starting the next test. We
1.54 +// double-check that the plugin is gone by the time we're done by
1.55 +// trying to crash it again, after we expect it to have crashed already.
1.56 +//
1.57 +function runTest() {
1.58 + // Have the plugin throw away its X resources, one of which is
1.59 + // probably a drawable to which we hold a reference
1.60 + document.getElementById("plugin").destroySharedGfxStuff();
1.61 +
1.62 + // Do something that's (hopefully) equivalent to an XSync() to allow
1.63 + // the resource destruction to propagate to the server
1.64 + XSync();
1.65 +
1.66 + // Set up a scroll to happen soon
1.67 + window.setTimeout(scrollOfDeath, 100);
1.68 +}
1.69 +
1.70 +window.addEventListener("MozReftestInvalidate", runTest, false);
1.71 + </script>
1.72 + </head>
1.73 +
1.74 + <body style="width: 400px; height: 10000px;">
1.75 + <embed id="plugin" type="application/x-test"
1.76 + style="position:absolute;
1.77 + top:100px; left:50px; width:200px; height:200px;">
1.78 + </embed>
1.79 + </body>
1.80 +</html>
