#!/usr/bin/env bash
# Round 3(前情:probe_chromium_bisect.sh 证明 hardening 全部无罪,case 0 也崩;
# overcommit/ulimit 数据干净)。两件事:
#   1/2. 拿到崩溃的真实 FATAL 行 + gdb backtrace(此前日志被 head 截断,一直没见到)
#   3.   实测 Google 官方 chrome-headless-shell 在本宿主能否跑 —— 直接验证
#        「镜像弃发行版 chromium、改装 puppeteer pinned headless shell」修法的可行性
# 用法(服务器 repo 根): bash deploy/sandbox/probe_chromium_round3.sh [镜像名]
set -u
IMG="${1:-zcbot-sandbox:latest}"

echo "===== 1. 崩溃日志尾部(找 FATAL/CHECK 行) ====="
docker run --rm --user zcbot -e HOME=/tmp --entrypoint bash "$IMG" -c '
  /usr/lib/chromium/chromium --no-sandbox --headless --disable-gpu --disable-dev-shm-usage \
      --enable-logging=stderr --v=1 --dump-dom about:blank >/tmp/c.log 2>&1; echo "rc=$?"
  echo "--- FATAL/CHECK grep ---"
  grep -aE "FATAL|Check failed|SIG|assert" /tmp/c.log | head -10
  echo "--- tail 30(去 dbus 噪音) ---"
  grep -aviE "dbus" /tmp/c.log | tail -30
  echo "--- cpu 安全特性 flags(pku/shstk/ibt,供对照) ---"
  grep -oE "pku|user_shstk|ibt" /proc/cpuinfo | sort -u | tr "\n" " "; echo'

echo
echo "===== 2. gdb backtrace(best-effort:apt 现装 gdb,网络不通自动跳过) ====="
docker run --rm --entrypoint bash "$IMG" -c '
  export DEBIAN_FRONTEND=noninteractive
  if apt-get update -qq >/dev/null 2>&1 && apt-get install -y -qq gdb >/dev/null 2>&1; then
    HOME=/tmp gdb -batch -ex run -ex "bt 12" \
      --args /usr/lib/chromium/chromium --no-sandbox --headless --disable-gpu \
      --disable-dev-shm-usage --dump-dom about:blank 2>&1 | grep -aviE "dbus" | tail -25
  else
    echo "[SKIP] apt 装 gdb 失败(容器网络不通?)"
  fi'

echo
echo "===== 3. Google 官方 chrome-headless-shell 实测(验证修法 A) ====="
docker run --rm --user zcbot -e HOME=/tmp --entrypoint bash "$IMG" -c '
  set -u
  cd /tmp
  # npm 包源走阿里(npx 拉 @puppeteer/browsers 包本身);二进制源三级 fallback:
  # 阿里 CDN -> 阿里 registry binary 路径 -> Google 官方
  export npm_config_registry="https://registry.npmmirror.com"
  ok=""
  for BASE in "https://cdn.npmmirror.com/binaries/chrome-for-testing" \
              "https://registry.npmmirror.com/-/binary/chrome-for-testing" \
              ""; do
    echo "[download] chrome-headless-shell@stable base-url=${BASE:-官方} ..."
    if npx -y @puppeteer/browsers install chrome-headless-shell@stable \
          --path /tmp/pptr ${BASE:+--base-url "$BASE"} >/tmp/dl.log 2>&1; then
      ok=1; break
    fi
    tail -2 /tmp/dl.log
  done
  [ -n "$ok" ] || { echo "[FAIL] 三个源都下不动"; tail -5 /tmp/dl.log; exit 1; }
  BIN=$(find /tmp/pptr -type f -name chrome-headless-shell | head -1)
  [ -n "$BIN" ] || { echo "[FAIL] 下载完成但没找到二进制"; exit 1; }
  echo "BIN=$BIN"
  "$BIN" --no-sandbox --disable-dev-shm-usage --dump-dom about:blank >/tmp/s.log 2>&1; rc=$?
  if [ $rc -eq 0 ]; then
    echo "[PASS] headless-shell 裸跑 rc=0"
  else
    echo "[FAIL] headless-shell 裸跑 rc=$rc"; grep -aviE "dbus" /tmp/s.log | tail -5
  fi
  printf "{\"executablePath\":\"%s\",\"args\":[\"--no-sandbox\",\"--disable-dev-shm-usage\"]}" "$BIN" > /tmp/pc.json
  printf "flowchart TB\n  A-->B\n" > /tmp/d.mmd
  if timeout 60 mmdc -i /tmp/d.mmd -o /tmp/d.png -p /tmp/pc.json >/tmp/m.log 2>&1 && [ -s /tmp/d.png ]; then
    echo "[PASS] mmdc + headless-shell 出图:"; ls -l /tmp/d.png
  else
    echo "[FAIL] mmdc + headless-shell 没出图"; tail -5 /tmp/m.log
  fi'

echo
echo "===== 判读 ====="
echo "3 两条 PASS           => 修法定案:Dockerfile 弃 apt chromium,build 时装 puppeteer pinned chrome-headless-shell"
echo "3 同样 SIGTRAP        => 宿主级问题(内核/CPU x 新版 chromium 通杀),看 1/2 的 FATAL 与 backtrace 再定"
echo "3 下载失败            => 网络问题,先解决容器出网/换 mirror 再跑"