Bug 1763581. Add test. r=aosmond

Differential Revision: https://phabricator.services.mozilla.com/D143968
2022-04-21 08:01:10 +00:00 · 2022-04-21 08:01:10 +00:00 · 6226b1e342
--- a/image/test/crashtests/1763581-1-iframe.html
+++ b/image/test/crashtests/1763581-1-iframe.html
@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script>
+      window.onload = function() {
+        img = document.querySelector(".animated-image")
+        const staticImage = new Image();
+        staticImage.src = img.src;
+      }
+    </script>
+  </head>
+  <body>
+    <img class="animated-image" src="1763581-1.sjs">
+  </body>
+</html>
--- a/image/test/crashtests/1763581-1.gif
+++ b/image/test/crashtests/1763581-1.gif
--- a/image/test/crashtests/1763581-1.html
+++ b/image/test/crashtests/1763581-1.html
@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+window.onload = function() {
+    setTimeout(step, 500);
+}
+
+var reloads = 5;
+
+function step() {
+    if (--reloads) {
+        document.getElementById("ifr").contentWindow.location.reload();
+    } else {
+        document.documentElement.className = "";
+    }
+}
+
+function settimouestep() {
+    setTimeout(step, 500);
+}
+</script>
+</head>
+<body>
+  <iframe id="ifr" src="1763581-1-iframe.html" height="500" width="400" onload="settimouestep()"></iframe>
+</body>
+</html>
+
--- a/image/test/crashtests/1763581-1.sjs
+++ b/image/test/crashtests/1763581-1.sjs
@ -0,0 +1,71 @@
+
+function getFileStream(filename)
+{
+  // Get the location of this sjs file, and then use that to figure out where
+  // to find where our other files are.
+  var self = Components.classes["@mozilla.org/file/local;1"]
+                       .createInstance(Components.interfaces.nsIFile);
+  self.initWithPath(getState("__LOCATION__"));
+  var file = self.parent;
+  file.append(filename);
+
+  var fileStream = Components.classes['@mozilla.org/network/file-input-stream;1']
+                     .createInstance(Components.interfaces.nsIFileInputStream);
+  fileStream.init(file, 1, 0, false);
+
+  return fileStream;
+}
+
+// stolen from file_blocked_script.sjs
+function setGlobalState(data, key) {
+  x = {
+    data,
+    QueryInterface: ChromeUtils.generateQI([]),
+  };
+  x.wrappedJSObject = x;
+  setObjectState(key, x);
+}
+
+function getGlobalState(key) {
+  var data;
+  getObjectState(key, function(x) {
+    data = x && x.wrappedJSObject.data;
+  });
+  return data;
+}
+
+const DELAY_MS = 100;
+let gTimer;
+
+function handleRequest(request, response) {
+  let count = getGlobalState("count");
+  if (count == null) {
+    count = 0;
+  }
+
+  if (count > 0) {
+    response.processAsync();
+
+    gTimer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+    gTimer.init(
+      () => {
+        response.setStatusLine(request.httpVersion, 304, "Not Modified");
+        response.finish();
+      },
+      DELAY_MS,
+      Ci.nsITimer.TYPE_ONE_SHOT
+    );
+
+    return;
+  }
+
+  response.setStatusLine(request.httpVersion, 200, "OK");
+  response.setHeader("Content-Type", "image/gif", false);
+
+  var inputStream = getFileStream("1763581-1.gif");
+  response.bodyOutputStream.writeFrom(inputStream, inputStream.available());
+  inputStream.close();
+
+  count++;
+  setGlobalState(count, "count");
+}
--- a/image/test/crashtests/crashtests.list
+++ b/image/test/crashtests/crashtests.list
@ -68,3 +68,4 @@ skip-if(ThreadSanitizer) load 1629490-1.html
 HTTP load 1634839-1.html
 HTTP load 1634839-2.html
 pref(image.animated.decode-on-demand.batch-size,1) pref(image.animated.decode-on-demand.threshold-kb,0) HTTP load 1676172-1.html
+pref(browser.soft_reload.only_force_validate_top_level_document,false) HTTP load 1763581-1.html