Root Access

allquixotic

18:00

I do this stuff for a living -- imagine how much fun work is for me

Braiam

@ThatBrazilianGuy we love finding why things "go wrong"

we are in SE after all D:

allquixotic

Bob is going to be SO depressed that he missed out on this.

Psycogeek

I am glad your all enjoying fixing this, before i have to use it :-)

Braiam

hehehehehe

That Brazilian Guy

!!xkcd 242

ChatBot John Cavil

18:01

How could you choose avoiding a little pain over understanding a magic lightning machine?

nhinkle

@allquixotic how to tell?

allquixotic

@nhinkle about:support in the address bar, and look for "Azure"

nhinkle

Graphics
Adapter Description	Intel(R) HD Graphics 4000
Adapter Drivers	igdumdim64 igd10iumd64 igd10iumd64 igdumdim32 igd10iumd32 igd10iumd32
Adapter RAM	Unknown
Device ID	0x0166
Direct2D Enabled	true
DirectWrite Enabled	true (6.3.9600.16384)
Driver Date	8-26-2013
Driver Version	10.18.10.3282
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Vendor ID	0x8086
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics 4000 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d

allquixotic

ok same canvas backend as me

Braiam

wait, is @nhinkle able to reproduce it?

nhinkle

18:06

@Braiam yes.

allquixotic

@Braiam somewhat

nhinkle

Not a full crash, but extreme freezing, absurd memory usage, and CPU spike.

allquixotic

he doesn't OOM, but he definitely has the memory bloat

That Brazilian Guy

35 secs ago, by nhinkle

Not a full crash, but extreme freezing, absurd memory usage, and CPU spike.

same here, but eats ALL 4GB memory and 100% of 1 processor

Braiam

I've discovered that I didn't had the KillXserver activated the first time it crashed...

allquixotic

18:07

too bad we don't have any gentooers who built firefox with debug symbols (@TomWijsman)

nhinkle

@slhck quick help us break things for science!

2

allquixotic

could gdb it, then break when it bloats, and step

terdon

@allquixotic here's a minimal version that still crashes my FF:

<?xml version="1.0"?>
<svg xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://www.w3.org/2000/svg" xmlns:osb="http://www.openswatchbook.org/uri/2009/osb" xmlns:cc="http://creativecommons.org/ns#" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" id="svg2" viewBox="0 0 858.5 854.82" version="1.1">
  <defs id="defs4">
    <filter id="filter3989-61" width="1.5" y="-.23" x="-.26" height="1.5" color-interpolation-filters="sRGB">
      <feDiffuseLighting id="feDiffuseLighting4025-31" result="result5" surfaceScale="16.48351669" diffuseConstan…

The problem seems to come down to this:

allquixotic

@terdon you're amazing -- that's an extremely short sample of code for a bloat like this. well done.

Tom Wijsman

@allquixotic Chromium without debug symbols. \o/

terdon

18:08

      <feDiffuseLighting id="feDiffuseLighting4025-31" result="result5" surfaceScale="16.48351669" diffuseConstant="1.29999995" kernelUnitLength="0.01">
        <feDistantLight id="feDistantLight4027-8" elevation="83" azimuth="260"/>
      </feDiffuseLighting>

slhck

@nhinkle Huh, what do you need?

terdon

Removing those lines stops the crash

allquixotic

@TomWijsman :(

nhinkle

50 mins ago, by That Brazilian Guy

Wanna crash your system? Click here using FF on linux and have fun!

Does your FF crash?

That Brazilian Guy

@slhck Wee need system crashes. For science.

slhck

18:09

Ah!

Anything goes… for science!

nhinkle

I smell a blog post coming on...

Braiam

wait, anyone tested on Chrome/ium?

slhck

Well, Firefox stops responding.

terdon

@allquixotic so, removing the <feDiffuseLighting> blah </feDiffuseLighting> seems to stop it

nhinkle

"The SU Firefox bughunting team!"

Oliver Salzburg

18:09

@Braiam Nothing happens for me :(

Braiam

or IE for what matters...

nhinkle

@slhck what happens to memory usage, and CPU usage? Crash or freeze? What version, and what platform, GPU, and graphics driver?

@Braiam no problems on chrome

slhck

@nhinkle sec :D

Oliver Salzburg

@Braiam Takes like 30 secs to render, then displays same image as Chrome

allquixotic

@nhinkle the amount of effort we're put into this definitely merits a blog post or something -- this has been going on for hours -- the general idea is that we took a very high level question asked on SU by @ThatBrazilianGuy and drilled down to "a certain snippet of SVG causes certain graphics drivers driven by Firefox's SVG renderer to bug out like crazy and peg the CPU and eat memory"

Braiam

18:11

ok, then the facts: it is Firefox, happens in Windows, Linux and Mac's... I think), and a very small snip SVG image causes the problem

slhck

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0) Gecko/20100101 Firefox/25.0

allquixotic

oh god, it's on Mac too!

Tom Wijsman

@nhinkle FF 25.0 crashes here too.

slhck

allquixotic

@TomWijsman Gentoo?

Why am I the only one for whom it doesn't crash?!?!

Tom Wijsman

18:12

Yeah, but binary version for if I need to test something quick.

slhck

Stays at ~3 GB memory and 100% CPU.

Tom Wijsman

It can very well be possible for a compiled version to not reproduce this... ;)

slhck

Model Name: MacBook Pro
Model Identifier: MacBookPro8,2
Processor Name: Intel Core i7
Processor Speed: 2.2 GHz
Number of Processors: 1
Total Number of Cores: 4
L2 Cache (per Core): 256 KB
L3 Cache: 6 MB
Memory: 8 GB
Boot ROM Version: MBP81.0047.B27
SMC Version (system): 1.69f4
Chipset Model: AMD Radeon HD 6750M
Type: GPU
Bus: PCIe
PCIe Lane Width: x8
VRAM (Total): 1024 MB
Vendor: ATI (0x1002)
Device ID: 0x6741
Revision ID: 0x0000
ROM Revision: 113-C0170L-573
gMux Version: 1.9.23
EFI Driver Version: 01.00.573

allquixotic

100% CPU is the hallmark of the bug

Tom Wijsman

eg. -Ofast VS -O2, etc... can cause bugs to show up or hide.

allquixotic

18:13

anyone mind me linking to chat from mozilla bugzilla?

gonna post this with as much info as we have

Braiam

not me...

terdon

Not at all but hang on, I narrowed it down further @allquixotic

Minimal file:

<?xml version="1.0"?>
<svg xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://www.w3.org/2000/svg" xmlns:osb="http://www.openswatchbook.org/uri/2009/osb" xmlns:cc="http://creativecommons.org/ns#" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" id="svg2" viewBox="0 0 858.5 854.82" version="1.1">
  <defs id="defs4">
    <filter id="filter3989-61" width="1.5" y="-.23" x="-.26" height="1.5" color-interpolation-filters="sRGB">
      <feDiffuseLighting id="feDiffuseLighting4025-31" result="result5" surfaceScale="16.48351669" diffuseConstan…

slhck

@allquixotic go ahead

terdon

It seems to be a problem between <feDiffuseLighting> bkah </feDiffuseLighting>

and the <path id=" line

Oliver Salzburg

10

Q: Android 4.4: How to get the Easter Egg and unlock the Dessert Case daydream?

Similar to Android 4.2/4.3 easter eggs, does 4.4 KitKat have similar or other ones?

Sweet :D

slhck

18:15

Quite literally…

Braiam

yeah...

terdon

@terdon removing EITHER of the two lines, removes the crash @allquixotic

Braiam

have we nailed down if the backend is the culprit or something else?

That Brazilian Guy

Have I ever said I love you guys? This has to be the best geek community I ever been. I think I never had so much fun in this room. (and for science!)

terdon

Awww :)

nhinkle

18:17

Everybody fill this out: docs.google.com/forms/d/…

5

I want to get a matrix of when the problem does and doesn't occur

And here's the edit page if any of you want to work with the data

docs.google.com/spreadsheet/…

allquixotic

I don't have access to the doc, so put down my data point: Windows 7 32-bit, Nvidia NVS 300, graphics driver 8.17.12.5993 from 10/16/2010, running Firefox 24.1.1 ESR and Firefox 25.0.1: Can not reproduce the problem at all in either version of FF.

and my AzureCanvas and AzureContentBackends are direct2d

slhck

FIRST :D

Braiam

@slhck nah... was me :P

@allquixotic I bet that is because you are 32-bits...

allquixotic

@Braiam yeah, but Hinkle's browser is 32-bit also

Oliver Salzburg

@nhinkle It takes a while (1.5 minutes) but it renders the image for me. Does that count as a freeze?

allquixotic

18:23

he's on 64-bit Windows 8.1, but his browser is 32-bit, I'm sure of it

slhck

@OliverSalzburg What does it show, actually?

allquixotic

Windows always uses 32-bit browsers

That Brazilian Guy

Is it "3.0 Mesa 9.2.3" my graphics driver?

Oliver Salzburg

@slhck Same as Chrome, IE

nhinkle

@OliverSalzburg is it super-high memory usage or CPU usage?

allquixotic

18:23

@OliverSalzburg look at your CPU and memory usage while it's rendering in order to determine whether you are subject to the bug

Oliver Salzburg

@nhinkle Utilized 100% on one core

allquixotic

@ThatBrazilianGuy yes, that is sufficient

the 3.0 is your OpenGL version though

just put Mesa 9.2.3 and your GPU make/model

Braiam

@ThatBrazilianGuy glxinfo | grep "OpenGL renderer string"

That Brazilian Guy

Gallium 0.4 on NV98

Braiam

that tells even the driver D:

nouveau 98?

Oliver Salzburg

18:24

It still responds kinda sluggish. But it didn't really freeze/crash. It performs far worse than Chrome though and I don't think it should

allquixotic

@nhinkle can I get a link to the table behind this for my bugzilla defect, please/

@Braiam Gallium 0.4 on Nouveau, with the chipset being NV98

nhinkle

6 mins ago, by nhinkle

https://docs.google.com/spreadsheet/ccc?key=0AnUk3SRcR-SJdHhEWnRZd0Z4T3VzSEpid1V‌KWkNEQ1E&usp=sharing

Oliver Salzburg

After closing the tab with the SVG everything is back to normal

terdon

Well, mine KINDA crashes, it will come back if I leave it long enough and then freeze again

Boris_yo

@Psycogeek No display, only 4 LEDs.

That Brazilian Guy

18:25

@Braiam seems so

"nouveau -- Gallium 0.4 on NV98"

allquixotic

bugzilla.mozilla.org/show_bug.cgi?id=943985

terdon

@OliverSalzburg same here I guess, haven't managed to close, but since it does come back if I leave it I guess it would be fine.

allquixotic

here is the bug on bugzilla. please feel free to comment, but keep it civil, technically-focused, and don't add anything unless you have something to say that isn't already covered by my original post

Oliver Salzburg

@allquixotic So, no "First!!!"?

slhck

> Expected results: Doesn't crash

Brilliant.

Boris_yo

18:28

@Psycogeek I confused pictures. I wanted to ask if I could ground myself with DVD player but since it does not have ground pin, I guess I can't.

nhinkle

I made a column to extract the relevant info from about:support

Braiam

@allquixotic there, I'm in the CC list and my vote was casted ;)

Boris_yo

@Psycogeek Never turns off, no matter what battery is in slot. It does get dimmer but never turns off. The charger did not come with manual.

Psycogeek

@Boris_yo what if no battery is in it?

allquixotic

this is freaking cool -- well done, everyone, let's hope mozilla can isolate exactly the code that is wrong and fix it

terdon

18:31

We're so effin' geeky :)

3

Psycogeek

bugzilla.mozilla.org/… SVG search, only a few hundred reported bugs with it, few anyone working on it. You guys might be enjoying it to much. Toss in some disgust every once in a while.

allquixotic

question for those of you who are able to render it correctly at all (crash/freeze or no)

does it look anything like this? i mean, look closely... do you see anything that's off about this?

I see one thing that's strange

54 mins ago, by Braiam

the checkered pattern is to be expected; that's just transparency, which resolves to white in FF. that's fine

what I notice is that the spheres are in grayscale on my system

maybe my graphics driver has a bug that it doesn't actually support whatever rendering feature is being used there, so that's why I don't crash

it is very old, after all

Braiam

@allquixotic mine is older, tho... Radeon X1300

allquixotic

that would jive well with @terdon's observation that it's diffuse effects that cause the memory usage

so perhaps it is a platform-independent issue that only doesn't occur if your driver is too old ;p

terdon

heh

Oliver Salzburg

18:34

@allquixotic Looks exactly like that. Just not in IE :D

allquixotic

@OliverSalzburg hm

is @Braiam the only one who sees the spheres as colored gold-ish?

open it up in gimp or EOG or another browser if you want

Braiam

@allquixotic the "white" dots are supposed to be bulbs like in the theater

terdon

@allquixotic no, that's what I get in my image viewer as well.

nhinkle

So the bug's happening on Cairo, quartz, skia, and direct2d. All rendering engines.

allquixotic

@nhinkle so it's not tied to a specific rendering backend, unless we're all unwittingly falling back to skia?

Braiam

18:36

no, must be the "backend"

allquixotic

or cairo

nhinkle

@allquixotic my fallback is cairo

allquixotic

mine too

Oliver Salzburg

nhinkle

Also I changed it so even if you don't fail it lets you go put in your details

Oliver Salzburg

18:36

IE is yellowish

nhinkle

I figure it's good to get info even for ones that don't fail

allquixotic

@OliverSalzburg so is The GIMP

Oliver Salzburg

Chrome and FF have grey gradients

Psycogeek

@OliverSalzburg I get that in IE10 too win7 64bit, looks like poo compared to what it probably should look like assuming the gimp shows it for real.

allquixotic

@OliverSalzburg Chrome and FF? yet Chrome renders it correctly without any CPU or RAM spikes, right?

terdon

18:38

@allquixotic this is Gimp on Debian:

Oliver Salzburg

@allquixotic Yeah. It renders instant in Chrome

terdon

That Brazilian Guy

Gimp:

Oliver Salzburg

@Psycogeek I'm on 11 even

That Brazilian Guy

terdon

18:39

Chrome shows this:

That Brazilian Guy

inkscape:

nhinkle

@allquixotic chrome doesn't render the lights right for me

allquixotic

I think this defect is going to get a lot of attention, because sites that accept arbitrary HTML will also accept arbitrary SVG, and apparently you can crash a great many peoples' web browsers just by stuffing this in a webpage somewhere, so it's almost a security defect

That Brazilian Guy

terdon

Sorry, chrome shows this:

allquixotic

18:39

is anyone else of the opinion that this is actually a security (Denial of Service) defect?

terdon

Braiam

@allquixotic I would add the security flag

allquixotic

@Braiam that would make it private, though

Braiam

meh, I would report it to launchpad so it gets fire from downstream

allquixotic

I don't think ubuntu would give a rat's behind, honestly -- they'll just say "Mozilla problem"

especially since it's not Linux-specific

terdon

18:41

It has nothing at all to do with Ubuntu, how did Ubuntu get into this?

slhck

Especially since it's Ubuntu.

terdon

It happens on Fedora and Debian

Boris_yo

@Psycogeek LED is fully off.

allquixotic

@terdon and OS X, and Windows 8.1

Oliver Salzburg

@allquixotic I don't see how

Boris_yo

18:41

@terdon QR scanner does not recognize!

Braiam

O_O

@Boris_yo really?

nhinkle

@OliverSalzburg malicious page puts SVG in page to crash browser. User is denied use of browser. DOS.

allquixotic

@OliverSalzburg even forums that don't allow you to enter arbitrary HTML, but do allow you to embed images, which is basically every comments section on every website, you could just do something like [img]http://whateverthelink.com/lol.svg[/img] and send tons of people crashing/freezing

there are tons and tons and tons of forums and regular news sites etc. that are very restrictive about what they allow, but they do allow image embedding

hell... SE

slhck

At least it could make you lose unsaved data.

nhinkle

True. On use-submitted pages you could cause them to crash an arbitrary page.

allquixotic

18:42

if somebody embedded the offending SVG in a popular SO question, it would crash tons of people

nhinkle

@allquixotic although few allow uploading SVG. It's mostly bitmap formats.

allquixotic

@nhinkle most sites don't check, to be honest

That Brazilian Guy

@allquixotic Don't go giving me ideas...

allquixotic

since I'm the only one who doesn't experience a memory or CPU usage spike, I have to conclude that I'm not experiencing the symptoms due to my ancient graphics driver, and that people with modern drivers that implement the requested APIs are getting the same behavior consistently across platforms

my driver's probably like "sorry brah, I don't support diffuse whatevers, so just draw it without them"

Braiam

MY SYSTEM IS FROM THE 2002!!

allquixotic

18:44

@Braiam but your driver is newer, right?

glxinfo... I can't view pastebin :/

you can just paste it right into chat, or github gist

Psycogeek

@Boris_yo It might be that the 1st slot is not charging correct. You should monitor voltage (at least) and see how it is going. most of those chargers are pure garbage , but will charge (even branded ones are junk). A good charger isnt cheap at all, but is completly different. .It would be a Very rare (never heard of it) charger that would use it as a "power light" or some such thing. It would be somewhat rare that the light being on wrongly didnt reflect a fail in the charge pattern itself.

Oliver Salzburg

I don't consider having my browser crashed a security issue. It's a stability issue. Unless the vector that caused the crash also allowed the attacker to inject code somehow. But in this case it doesn't even crash my browser, it's just annoying.

Who knows what kind of code you guys just injected into my system!!

Braiam

@allquixotic gist.github.com/braiam/7681018

@OliverSalzburg but the label said "vitamins" D:

nhinkle

0

Q: Test question - please ignore

Please ignore this post. We're testing a Firefox bug.

discussion

Embedding it doesn't crash the browser.

But, the page is laggy and slow to scroll.

Oliver Salzburg

@nhinkle Upvotes!!!

allquixotic

18:48

@nhinkle I don't even see it.

slhck

I don't see it either.

In Chrome.

That Brazilian Guy

@nhinkle Say it for yourself. It "crashes" (as in eats ALL RAM AND CPU) in mine

and I don't see it either.

allquixotic

@ThatBrazilianGuy even the SU question does? nice

even weirder that the image doesn't display, period, in certain browsers on meta.SU

but that's an orthogonal issue, I think

terdon

I dont see it on chrome on my ipad, will test other browsers in a sec. No crash though

Braiam

@nhinkle mine does...

allquixotic

18:52

if I don't hear back from any Mozilla employees or significant community contributors RE: the bugzilla bug by the time I get home from work, I will most certainly ask on mozilla IRC as well.

we need to get to the bottom of exactly what this is and how to fix it so that it gets out in the next firefox update, and I've kinda made it my mission to ensure that

Oliver Salzburg

@nhinkle The complexity of the image probably has an effect on the issue

That Brazilian Guy

@allquixotic Fear not, as it's an open source project, it will be fixed quickly (in about 10 years or so!)

Oliver Salzburg

FF probably has a problem with the radial gradient or something

allquixotic

if this turns out not to be hardware related at all (though I don't see how that could be the case), one code change could fix it... if it is in fact hardware related somehow, or driver-specific, they may have to do some kind of whitelist for good drivers

@ThatBrazilianGuy I sympathize with your cynicism, I really do, but I could easily see this being considered a security issue, in which case, it will get top-level attention from Mozilla and its contributors

Boris_yo

@Psycogeek I don't know how to monitor voltage. No built-in monitor exist. The reason I picked that one is because it had 4 isolated charging channels, unlike 2 and 2 channels that take at least 2 batteries to start charging process.

Braiam

18:55

lol, I evaded SE CAPTCHA... just closed the dialog and try again D:

allquixotic

it's borderline security, because the only category you could put it into is DoS

rlemon

o/

Braiam

let's ask @rlemon his opinion

38 mins ago, by nhinkle

Everybody fill this out: https://docs.google.com/forms/d/1j-FhqxeT6TA24tBo_wkUmUmOKs-AbZ05ZN4tx1Wgw-Q/vie‌wform

allquixotic

@rlemon another victim to add a data point to our bug hunt! \o/

Boris_yo

@rlemon Yello

allquixotic

18:56

3

Q: Visiting a site turns the system unresponsive

I'm using Firefox firefox-25.0-3.fc19.x86_64 on Fedora 19 (kernel 3.11.9-200.fc19.x86_64). If I open this link using firefox, my system becomes unresponsive. Running htop on a second monitor shows a massive spike in memory usage, my 3954 MB of RAM gets all used up immediately, then the swap gets ...

linux firefox memory freeze troubleshooting

rlemon

I have a unique situation i've been dealing with over the past few months, would like some advice on how to copy this tablet (complete image) via the usb port to my desktop

allquixotic

the basic idea is, run Firefox and click on the SVG link

!!tell 12377632 maybe

ChatBot John Cavil

allquixotic

I'll try to help, but I'll be multitasking, as we are very busy with a high priority, potential security defect in firefox that we found mere hours ago and isn't already in mozilla bugzilla

in other words, drop everything and help save the world

Boris_yo

@rlemon Which tablet?

rlemon

18:57

ASUS sent me a dev (or QA) unit by mistake. the sn on the tablet doesn't match up with the warrenty or box so the store is saying FU and so is asus

Braiam

@rlemon if it's android adb is your friend

rlemon

windows 8 :/

allquixotic

@rlemon it's a windows 8 tablet? pro or RT?

Boris_yo

@allquixotic Is it that critical situation? Why you call it exploit? Who would it be possible to exploit?

rlemon

after months of arguing with asus support they are willing to look at it. but i want to have as much proof as possible of what they sent me. making a complete backup of the tablets os and installed programs / files is my next step

Boris_yo

18:58

@Braiam adb?

That Brazilian Guy

I'd love someone sending me a FF OS device by mistake (as in, "we don't even know who you are, but here, have this phone" mistake)

rlemon

and windows 8 core (not pro)

Psycogeek

@Boris_yo having seperate channles is a start, but there is a lot more to a good charge alogrythm to get batteries to last time, not get cooked, not get overcharges, to be charged proper and all. With a voltage meter you just read the voltages of the battery. either always, or when it should be charged. then it gets rather complicated with what it should be showing.

allquixotic

@Boris_yo take for example, a website that has a comments section at the bottom of every story, and just so happens to let users embed images... now suddenly, everyone who's vulnerable to the issue will have a crashed browser and tons of memory pressure and CPU just from a simple image embed

That Brazilian Guy

2

Q: What's ADB and why is it used for? How do I install it on my device?

There are mentions about ADB on various questions and answers on this site. I'm not exactly sure what ADB is, what it does, how it works and where I can get it: there's little information on the tag wiki besides the link for ADB on the android developer site. On the site itself, the language is ...

adb

rlemon

18:58

@ThatBrazilianGuy unfortunately my company payed $700 for the tablet.

allquixotic

@rlemon so it's an x86 processor, not ARM?

rlemon

correct

allquixotic

@rlemon in that case, pop a Linux bootable live CD in a USB CD/DVD drive, plug it into the tablet, and dd off the /dev/sda to a file on a remote USB HDD or flash drive with enough capacity

rlemon

I was going to just boot into linux and dd, but then I remembered I can't just open up the tablet and mount the ssd. I need to somehow get the tablets ssd to mount via the usb port :/

ahhh snap. usb cd rom.

never thought of that

Transcript for