/* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ // For bug 1471989, test that an exception saved by chrome code can't leak the page. add_task(async function test() { const testUrl = "http://mochi.test:8888/browser/js/xpconnect/tests/browser/browser_consoleStack.html"; let newTab = await BrowserTestUtils.openNewForegroundTab( gBrowser, "http://mochi.test:8888/" ); let browser = gBrowser.selectedBrowser; let stackTraceEmpty = await SpecialPowers.spawn( browser, [testUrl], async function (testUrl) { let { TestUtils } = ChromeUtils.importESModule( "resource://testing-common/TestUtils.sys.mjs" ); let { Assert } = ChromeUtils.importESModule( "resource://testing-common/Assert.sys.mjs" ); let iframe = content.document.createElement("iframe"); iframe.src = testUrl; content.document.body.appendChild(iframe); await new Promise(resolve => iframe.addEventListener("load", resolve, { once: true }) ); const ConsoleAPIStorage = Cc[ "@mozilla.org/consoleAPI-storage;1" ].getService(Ci.nsIConsoleAPIStorage); let iframeInnerWindowId = iframe.contentWindow.windowGlobalChild.innerWindowId; let consoleEvents = ConsoleAPIStorage.getEvents(iframeInnerWindowId); Assert.equal( consoleEvents.length, 1, "Should only be one console event for the window" ); // Intentionally hold a reference to the console event. let leakedConsoleEvent = consoleEvents[0]; // XXX I think this is intentionally leaking |doc|. // eslint-disable-next-line no-unused-vars let doc = iframe.contentDocument; let promise = TestUtils.topicObserved("inner-window-nuked", subject => { let id = subject.QueryInterface(Ci.nsISupportsPRUint64).data; return id == iframeInnerWindowId; }); iframe.remove(); await promise; // This string should be empty. For that to happen, two things // need to be true: // // a) ConsoleCallData::mStack is not null. This means that the // stack trace was not reified before the page was nuked. If it // was, then the correct |filename| value would be stored on the // object. (This is not a problem, except that it stops us from // testing the next condition.) // // b) ConsoleData::mStack.mStack is null. This means that the // JSStackFrame is keeping alive the JS object in the page after // the page was nuked, which leaks the page. return leakedConsoleEvent.stacktrace[0].filename; } ); is( stackTraceEmpty, "", "JSStackFrame shouldn't leak mStack after window nuking" ); BrowserTestUtils.removeTab(newTab); });