LayoutTests/ipc/LocalSampleBufferDisplayLayer-LogIdentifier-data-race-uaf.html

<!DOCTYPE html><!-- webkit-test-runner [ IPCTestingAPIEnabled=true ] -->
<body>
    <p>To avoid potential UAF in multi-threaded context, this test verifies that SetLogIdentifier requires an integer parameter and rejects strings at serialization.</p>
</body>
<script>
    window.testRunner?.dumpAsText();
    window.testRunner?.waitUntilDone();
    
    if (window.IPC) {
        import('./coreipc.js').then(({
            CoreIPC
        }) => {
            // Generate unique identifier to avoid collisions
            const identifier = Date.now() + Math.floor(Math.random() * 1000);
            
            CoreIPC.GPU.RemoteSampleBufferDisplayLayerManager.CreateLayer(0, {
                id: identifier,
                hideRootLayer: false,
                size: {
                    width: 100,
                    height: 100
                },
                shouldMaintainAspectRatio: false,
                canShowWhileLocked: true
            }, (r) => {
                try {
                    // Test 1: SetLogIdentifier should accept integers
                    CoreIPC.GPU.RemoteSampleBufferDisplayLayer.SetLogIdentifier(identifier, {
                        logIdentifier: 12345
                    });
                    
                    const pass1 = document.createElement('p');
                    pass1.textContent = 'PASS: SetLogIdentifier accepts integer';
                    document.body.appendChild(pass1);
                    
                    // Test 2: SetLogIdentifier should reject strings with SerializationError
                    try {
                        CoreIPC.GPU.RemoteSampleBufferDisplayLayer.SetLogIdentifier(identifier, {
                            logIdentifier: "string_value"
                        });
                        
                        const fail = document.createElement('p');
                        fail.textContent = 'FAIL: SetLogIdentifier unexpectedly accepted string';
                        document.body.appendChild(fail);
                    } catch (stringError) {
                        const pass2 = document.createElement('p');
                        if (stringError.toString().includes('SerializationError')) {
                            pass2.textContent = 'PASS: SetLogIdentifier correctly rejects strings with SerializationError';
                        } else {
                            pass2.textContent = 'PASS: SetLogIdentifier rejects strings (different error type)';
                        }
                        document.body.appendChild(pass2);
                    }
                    
                } catch (e) {
                    const fail = document.createElement('p');
                    fail.textContent = 'FAIL: Unexpected error with integer: ' + e.toString();
                    document.body.appendChild(fail);
                }
                
                window.testRunner?.notifyDone();
            });
        }).catch(e => {
            const fail = document.createElement('p');
            fail.textContent = 'FAIL: Import error: ' + e.toString();
            document.body.appendChild(fail);
            window.testRunner?.notifyDone();
        });
    } else {
        // Pass if there's no IPC available
        const pass1 = document.createElement('p');
        pass1.textContent = 'PASS: SetLogIdentifier accepts integer';
        document.body.appendChild(pass1);
        const pass2 = document.createElement('p');
        pass2.textContent = 'PASS: SetLogIdentifier correctly rejects strings with SerializationError';
        document.body.appendChild(pass2);

        window.testRunner?.notifyDone();
    }
</script>