ladybird/Tests/LibWeb/Text/input/WebSocket/WebSocket-gc.html

<!DOCTYPE html>
<script src="../include.js"></script>
<script>
    asyncTest((done) => {
        {
            const ws = new WebSocket('wss://websocket-echo.app.ladybird.org');

            ws.onopen = () => {
            };
            ws.onmessage = () => {
            };
            ws.onerror = () => {
            };
        }

        setTimeout(() => {
            internals.gc();
            println("PASS! (Didn't crash)");
            done();
        }, 0);
    });
</script>
Meta: Add DOCTYPEs to most text tests 2025-03-18 15:28:35 -03:00			`<!DOCTYPE html>`
LibGC: Visit the edges of the cells that must survive garbage collection Previously, we would only keep the cell that must survive alive, but none of it's edges. This cropped up with a GC UAF in must_survive_garbage_collection of WebSocket in .NET's SignalR frontend implementation, where an out-of-scope WebSocket had it's underlying EventTarget properties garbage collected, and must_survive_garbage_collection read from the destroyed EventTarget properties. See: https://github.com/dotnet/aspnetcore/blob/main/src/SignalR/clients/ts/signalr/src/WebSocketTransport.ts#L81 Found on https://www.formula1.com/ during a live session. Co-Authored-By: Tim Flynn <trflynn89@pm.me> 2025-02-27 11:50:22 -03:00			`<script src="../include.js"></script>`
			`<script>`
			`asyncTest((done) => {`
			`{`
Tests: Use own websocket echo server instead of websocket.org The public one at echo.websocket.org tends to be slow at times, frequently causing timeouts. Ideally we would run a local websocket server but for now we can make do with a self-hosted alternative. 2025-03-10 08:46:14 -03:00			`const ws = new WebSocket('wss://websocket-echo.app.ladybird.org');`
LibGC: Visit the edges of the cells that must survive garbage collection Previously, we would only keep the cell that must survive alive, but none of it's edges. This cropped up with a GC UAF in must_survive_garbage_collection of WebSocket in .NET's SignalR frontend implementation, where an out-of-scope WebSocket had it's underlying EventTarget properties garbage collected, and must_survive_garbage_collection read from the destroyed EventTarget properties. See: https://github.com/dotnet/aspnetcore/blob/main/src/SignalR/clients/ts/signalr/src/WebSocketTransport.ts#L81 Found on https://www.formula1.com/ during a live session. Co-Authored-By: Tim Flynn <trflynn89@pm.me> 2025-02-27 11:50:22 -03:00
			`ws.onopen = () => {`
			`};`
			`ws.onmessage = () => {`
			`};`
			`ws.onerror = () => {`
			`};`
			`}`

			`setTimeout(() => {`
			`internals.gc();`
			`println("PASS! (Didn't crash)");`
			`done();`
			`}, 0);`
			`});`
			`</script>`