1 files changed, 107 insertions, 0 deletions
diff --git a/dom/ipc/tests/test_bug1086684.html b/dom/ipc/tests/test_bug1086684.html
new file mode 100644
index 000000000..962826ec6
--- /dev/null
+++ b/dom/ipc/tests/test_bug1086684.html
@@ -0,0 +1,107 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for recursive CPOW-getting-cookie bug</title>
+  <script type="application/javascript"
+          src="/tests/SimpleTest/SimpleTest.js">
+  </script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+
+  <script type="application/javascript;version=1.8">
+    "use strict";
+
+    SimpleTest.waitForExplicitFinish();
+
+    const childFrameURL =
+      "http://mochi.test:8888/tests/dom/ipc/tests/file_bug1086684.html";
+
+    function childFrameScript() {
+      "use strict";
+
+      let { MockFilePicker } =
+        Components.utils.import("chrome://specialpowers/content/MockFilePicker.jsm", {});
+
+      function parentReady(message) {
+        MockFilePicker.init(content);
+        MockFilePicker.returnFiles = [message.data.file];
+        MockFilePicker.returnValue = MockFilePicker.returnOK;
+
+        let input = content.document.getElementById("f");
+        input.addEventListener("change", () => {
+          MockFilePicker.cleanup();
+          let value = input.value;
+          message.target.sendAsyncMessage("testBug1086684:childDone", { value });
+        });
+
+        input.focus();
+        input.click();
+      }
+
+      addMessageListener("testBug1086684:parentReady", function(message) {
+        parentReady(message);
+      });
+    }
+
+    let test;
+    function* testStructure(mm) {
+      let value;
+
+      function testDone(msg) {
+        test.next(msg.data.value);
+      }
+
+      mm.addMessageListener("testBug1086684:childDone", testDone);
+
+      let blob = new Blob([]);
+      let file = new File([blob], "helloworld.txt", { type: "text/plain" });
+
+      mm.sendAsyncMessage("testBug1086684:parentReady", { file });
+      value = yield;
+
+      // Note that the "helloworld.txt" passed in above doesn't affect the
+      // 'value' getter. Because we're mocking a file using a blob, we ask the
+      // blob for its path, which is the empty string.
+      is(value, "", "got the right answer and didn't crash");
+
+      SimpleTest.finish();
+    }
+
+    function runTests() {
+      info("Browser prefs set.");
+
+      let iframe = document.createElement("iframe");
+      SpecialPowers.wrap(iframe).mozbrowser = true;
+      iframe.id = "iframe";
+      iframe.src = childFrameURL;
+
+      iframe.addEventListener("mozbrowserloadend", function() {
+        info("Got iframe load event.");
+        let mm = SpecialPowers.getBrowserFrameMessageManager(iframe);
+        mm.loadFrameScript("data:,(" + encodeURI(childFrameScript.toString()) + ")();",
+                           false);
+
+        test = testStructure(mm);
+        test.next();
+      });
+
+      document.body.appendChild(iframe);
+    }
+
+    addEventListener("load", function() {
+      info("Got load event.");
+
+      SpecialPowers.addPermission("browser", true, document);
+      SpecialPowers.pushPrefEnv({
+        "set": [
+          ["dom.ipc.browser_frames.oop_by_default", true],
+          ["dom.mozBrowserFramesEnabled", true],
+          ["network.disable.ipc.security", true],
+          ["browser.pagethumbnails.capturing_disabled", true]
+        ]
+      }, runTests);
+    });
+  </script>
+</body>
+</html>