#!/bin/bash
# Reproduces the OnUnloadACK inner-delegate ResetChildren omission.
#
# Prerequisites:
#   1. From the Chromium src/ directory:
#        git apply /path/to/chromium-changes.patch
#        autoninja -C out/asan chrome
#   2. From this directory:  python3 server.py 8765 &
#
# The renderer-side hunk in chromium-changes.patch simulates a compromised
# renderer (sends FrameHost::CreateChildFrame on the inner-delegate
# placeholder, then AgentSchedulingGroupHost::DidUnloadRenderFrame without
# detaching the child). The browser-side hunk is observation-only logging
# that surfaces the resulting frame-tree state.

set -e
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PORT="${PORT:-8765}"

rm -rf /tmp/chrome-poc-profile
POC_INNER_DELEGATE=1 "$CHROME" \
  --no-sandbox --no-first-run --no-default-browser-check \
  --ignore-gpu-blocklist \
  --disable-features=PdfOopif \
  --user-data-dir=/tmp/chrome-poc-profile \
  --enable-logging=stderr --v=0 \
  "http://127.0.0.1:${PORT}/poc.html" 2>&1 \
  | grep -E 'POC\[|FATAL|INVARIANT'