I do this stuff for a living -- imagine how much fun work is for me

@ThatBrazilianGuy we love finding why things "go wrong"

we are in SE after all D:

Bob is going to be SO depressed that he missed out on this.

I am glad your all enjoying fixing this, before i have to use it :-)

hehehehehe

!!xkcd 242

@allquixotic how to tell?

@nhinkle about:support in the address bar, and look for "Azure"

Graphics
Adapter Description	Intel(R) HD Graphics 4000
Adapter Drivers	igdumdim64 igd10iumd64 igd10iumd64 igdumdim32 igd10iumd32 igd10iumd32
Adapter RAM	Unknown
Device ID	0x0166
Direct2D Enabled	true
DirectWrite Enabled	true (6.3.9600.16384)
Driver Date	8-26-2013
Driver Version	10.18.10.3282
GPU #2 Active	false
GPU Accelerated Windows	1/1 Direct3D 10
Vendor ID	0x8086
WebGL Renderer	Google Inc. -- ANGLE (Intel(R) HD Graphics 4000 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote	false
AzureCanvasBackend	direct2d

ok same canvas backend as me

wait, is @nhinkle able to reproduce it?

@Braiam yes.

@Braiam somewhat

Not a full crash, but extreme freezing, absurd memory usage, and CPU spike.

he doesn't OOM, but he definitely has the memory bloat

same here, but eats ALL 4GB memory and 100% of 1 processor

I've discovered that I didn't had the KillXserver activated the first time it crashed...

too bad we don't have any gentooers who built firefox with debug symbols (@TomWijsman)

@slhck quick help us break things for science!

could gdb it, then break when it bloats, and step

@allquixotic here's a minimal version that still crashes my FF:

<?xml version="1.0"?>
<svg xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://www.w3.org/2000/svg" xmlns:osb="http://www.openswatchbook.org/uri/2009/osb" xmlns:cc="http://creativecommons.org/ns#" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" id="svg2" viewBox="0 0 858.5 854.82" version="1.1">
  <defs id="defs4">
    <filter id="filter3989-61" width="1.5" y="-.23" x="-.26" height="1.5" color-interpolation-filters="sRGB">
      <feDiffuseLighting id="feDiffuseLighting4025-31" result="result5" surfaceScale="16.48351669" diffuseConstan…

The problem seems to come down to this:

@terdon you're amazing -- that's an extremely short sample of code for a bloat like this. well done.

@allquixotic Chromium without debug symbols. \o/

      <feDiffuseLighting id="feDiffuseLighting4025-31" result="result5" surfaceScale="16.48351669" diffuseConstant="1.29999995" kernelUnitLength="0.01">
        <feDistantLight id="feDistantLight4027-8" elevation="83" azimuth="260"/>
      </feDiffuseLighting>

@nhinkle Huh, what do you need?

Removing those lines stops the crash

@TomWijsman :(

Does your FF crash?

@slhck Wee need system crashes. For science.

Ah!

Anything goes… for science!

I smell a blog post coming on...

wait, anyone tested on Chrome/ium?

Well, Firefox stops responding.

@allquixotic so, removing the <feDiffuseLighting> blah </feDiffuseLighting> seems to stop it

"The SU Firefox bughunting team!"

@Braiam Nothing happens for me :(

or IE for what matters...

@slhck what happens to memory usage, and CPU usage? Crash or freeze? What version, and what platform, GPU, and graphics driver?

@Braiam no problems on chrome

@nhinkle sec :D

@Braiam Takes like 30 secs to render, then displays same image as Chrome

@nhinkle the amount of effort we're put into this definitely merits a blog post or something -- this has been going on for hours -- the general idea is that we took a very high level question asked on SU by @ThatBrazilianGuy and drilled down to "a certain snippet of SVG causes certain graphics drivers driven by Firefox's SVG renderer to bug out like crazy and peg the CPU and eat memory"

ok, then the facts: it is Firefox, happens in Windows, Linux and Mac's... I think), and a very small snip SVG image causes the problem

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:25.0) Gecko/20100101 Firefox/25.0

oh god, it's on Mac too!

@nhinkle FF 25.0 crashes here too.

@TomWijsman Gentoo?

Why am I the only one for whom it doesn't crash?!?!

Yeah, but binary version for if I need to test something quick.

Stays at ~3 GB memory and 100% CPU.

It can very well be possible for a compiled version to not reproduce this... ;)

100% CPU is the hallmark of the bug

eg. -Ofast VS -O2, etc... can cause bugs to show up or hide.

anyone mind me linking to chat from mozilla bugzilla?

gonna post this with as much info as we have

not me...

Not at all but hang on, I narrowed it down further @allquixotic

Minimal file:

<?xml version="1.0"?>
<svg xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://www.w3.org/2000/svg" xmlns:osb="http://www.openswatchbook.org/uri/2009/osb" xmlns:cc="http://creativecommons.org/ns#" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" id="svg2" viewBox="0 0 858.5 854.82" version="1.1">
  <defs id="defs4">
    <filter id="filter3989-61" width="1.5" y="-.23" x="-.26" height="1.5" color-interpolation-filters="sRGB">
      <feDiffuseLighting id="feDiffuseLighting4025-31" result="result5" surfaceScale="16.48351669" diffuseConstan…

@allquixotic go ahead

It seems to be a problem between <feDiffuseLighting> bkah </feDiffuseLighting>

and the <path id=" line

Sweet :D

Quite literally…

yeah...

@terdon removing EITHER of the two lines, removes the crash @allquixotic

have we nailed down if the backend is the culprit or something else?

Have I ever said I love you guys? This has to be the best geek community I ever been. I think I never had so much fun in this room. (and for science!)

Awww :)

I want to get a matrix of when the problem does and doesn't occur

And here's the edit page if any of you want to work with the data

docs.google.com/spreadsheet/…

I don't have access to the doc, so put down my data point: Windows 7 32-bit, Nvidia NVS 300, graphics driver 8.17.12.5993 from 10/16/2010, running Firefox 24.1.1 ESR and Firefox 25.0.1: Can not reproduce the problem at all in either version of FF.

and my AzureCanvas and AzureContentBackends are direct2d

FIRST :D

@slhck nah... was me :P

@allquixotic I bet that is because you are 32-bits...

@Braiam yeah, but Hinkle's browser is 32-bit also

@nhinkle It takes a while (1.5 minutes) but it renders the image for me. Does that count as a freeze?

he's on 64-bit Windows 8.1, but his browser is 32-bit, I'm sure of it

@OliverSalzburg What does it show, actually?

Windows always uses 32-bit browsers

Is it "3.0 Mesa 9.2.3" my graphics driver?

@slhck Same as Chrome, IE

@OliverSalzburg is it super-high memory usage or CPU usage?

@OliverSalzburg look at your CPU and memory usage while it's rendering in order to determine whether you are subject to the bug

@nhinkle Utilized 100% on one core

@ThatBrazilianGuy yes, that is sufficient

the 3.0 is your OpenGL version though

just put Mesa 9.2.3 and your GPU make/model

@ThatBrazilianGuy glxinfo | grep "OpenGL renderer string"

Gallium 0.4 on NV98

that tells even the driver D:

nouveau 98?

It still responds kinda sluggish. But it didn't really freeze/crash. It performs far worse than Chrome though and I don't think it should

@nhinkle can I get a link to the table behind this for my bugzilla defect, please/

@Braiam Gallium 0.4 on Nouveau, with the chipset being NV98

After closing the tab with the SVG everything is back to normal

Well, mine KINDA crashes, it will come back if I leave it long enough and then freeze again

@Psycogeek No display, only 4 LEDs.

@Braiam seems so

"nouveau -- Gallium 0.4 on NV98"

bugzilla.mozilla.org/show_bug.cgi?id=943985

@OliverSalzburg same here I guess, haven't managed to close, but since it does come back if I leave it I guess it would be fine.

here is the bug on bugzilla. please feel free to comment, but keep it civil, technically-focused, and don't add anything unless you have something to say that isn't already covered by my original post

@allquixotic So, no "First!!!"?

> Expected results: Doesn't crash

Brilliant.

@Psycogeek I confused pictures. I wanted to ask if I could ground myself with DVD player but since it does not have ground pin, I guess I can't.

I made a column to extract the relevant info from about:support

@allquixotic there, I'm in the CC list and my vote was casted ;)

@Psycogeek Never turns off, no matter what battery is in slot. It does get dimmer but never turns off. The charger did not come with manual.

@Boris_yo what if no battery is in it?

this is freaking cool -- well done, everyone, let's hope mozilla can isolate exactly the code that is wrong and fix it

We're so effin' geeky :)

bugzilla.mozilla.org/… SVG search, only a few hundred reported bugs with it, few anyone working on it. You guys might be enjoying it to much. Toss in some disgust every once in a while.

question for those of you who are able to render it correctly at all (crash/freeze or no)

does it look anything like this? i mean, look closely... do you see anything that's off about this?

I see one thing that's strange

the checkered pattern is to be expected; that's just transparency, which resolves to white in FF. that's fine

what I notice is that the spheres are in grayscale on my system

maybe my graphics driver has a bug that it doesn't actually support whatever rendering feature is being used there, so that's why I don't crash

it is very old, after all

@allquixotic mine is older, tho... Radeon X1300

that would jive well with @terdon's observation that it's diffuse effects that cause the memory usage

so perhaps it is a platform-independent issue that only doesn't occur if your driver is too old ;p

heh

@allquixotic Looks exactly like that. Just not in IE :D

@OliverSalzburg hm

is @Braiam the only one who sees the spheres as colored gold-ish?

open it up in gimp or EOG or another browser if you want

@allquixotic the "white" dots are supposed to be bulbs like in the theater

@allquixotic no, that's what I get in my image viewer as well.

So the bug's happening on Cairo, quartz, skia, and direct2d. All rendering engines.

@nhinkle so it's not tied to a specific rendering backend, unless we're all unwittingly falling back to skia?

no, must be the "backend"

or cairo

@allquixotic my fallback is cairo

mine too

Also I changed it so even if you don't fail it lets you go put in your details

IE is yellowish

I figure it's good to get info even for ones that don't fail

@OliverSalzburg so is The GIMP

Chrome and FF have grey gradients

@OliverSalzburg I get that in IE10 too win7 64bit, looks like poo compared to what it probably should look like assuming the gimp shows it for real.

@OliverSalzburg Chrome and FF? yet Chrome renders it correctly without any CPU or RAM spikes, right?

@allquixotic this is Gimp on Debian:

@allquixotic Yeah. It renders instant in Chrome

Gimp:

@Psycogeek I'm on 11 even

Chrome shows this:

inkscape:

@allquixotic chrome doesn't render the lights right for me

I think this defect is going to get a lot of attention, because sites that accept arbitrary HTML will also accept arbitrary SVG, and apparently you can crash a great many peoples' web browsers just by stuffing this in a webpage somewhere, so it's almost a security defect

Sorry, chrome shows this:

is anyone else of the opinion that this is actually a security (Denial of Service) defect?

@allquixotic I would add the security flag

@Braiam that would make it private, though

meh, I would report it to launchpad so it gets fire from downstream

I don't think ubuntu would give a rat's behind, honestly -- they'll just say "Mozilla problem"

especially since it's not Linux-specific

It has nothing at all to do with Ubuntu, how did Ubuntu get into this?

Especially since it's Ubuntu.

It happens on Fedora and Debian

@Psycogeek LED is fully off.

@terdon and OS X, and Windows 8.1

@allquixotic I don't see how

@terdon QR scanner does not recognize!

O_O

@Boris_yo really?

@OliverSalzburg malicious page puts SVG in page to crash browser. User is denied use of browser. DOS.

@OliverSalzburg even forums that don't allow you to enter arbitrary HTML, but do allow you to embed images, which is basically every comments section on every website, you could just do something like [img]http://whateverthelink.com/lol.svg[/img] and send tons of people crashing/freezing

there are tons and tons and tons of forums and regular news sites etc. that are very restrictive about what they allow, but they do allow image embedding

hell... SE

At least it could make you lose unsaved data.

True. On use-submitted pages you could cause them to crash an arbitrary page.

if somebody embedded the offending SVG in a popular SO question, it would crash tons of people

@allquixotic although few allow uploading SVG. It's mostly bitmap formats.

@nhinkle most sites don't check, to be honest

@allquixotic Don't go giving me ideas...

since I'm the only one who doesn't experience a memory or CPU usage spike, I have to conclude that I'm not experiencing the symptoms due to my ancient graphics driver, and that people with modern drivers that implement the requested APIs are getting the same behavior consistently across platforms

my driver's probably like "sorry brah, I don't support diffuse whatevers, so just draw it without them"

MY SYSTEM IS FROM THE 2002!!

@Braiam but your driver is newer, right?

glxinfo... I can't view pastebin :/

you can just paste it right into chat, or github gist

@Boris_yo It might be that the 1st slot is not charging correct. You should monitor voltage (at least) and see how it is going. most of those chargers are pure garbage , but will charge (even branded ones are junk). A good charger isnt cheap at all, but is completly different. .It would be a Very rare (never heard of it) charger that would use it as a "power light" or some such thing. It would be somewhat rare that the light being on wrongly didnt reflect a fail in the charge pattern itself.

I don't consider having my browser crashed a security issue. It's a stability issue. Unless the vector that caused the crash also allowed the attacker to inject code somehow. But in this case it doesn't even crash my browser, it's just annoying.

Who knows what kind of code you guys just injected into my system!!

@allquixotic gist.github.com/braiam/7681018

@OliverSalzburg but the label said "vitamins" D:

Embedding it doesn't crash the browser.

But, the page is laggy and slow to scroll.

@nhinkle Upvotes!!!

@nhinkle I don't even see it.

I don't see it either.

In Chrome.

@nhinkle Say it for yourself. It "crashes" (as in eats ALL RAM AND CPU) in mine

and I don't see it either.

@ThatBrazilianGuy even the SU question does? nice

even weirder that the image doesn't display, period, in certain browsers on meta.SU

but that's an orthogonal issue, I think

I dont see it on chrome on my ipad, will test other browsers in a sec. No crash though

@nhinkle mine does...

if I don't hear back from any Mozilla employees or significant community contributors RE: the bugzilla bug by the time I get home from work, I will most certainly ask on mozilla IRC as well.

we need to get to the bottom of exactly what this is and how to fix it so that it gets out in the next firefox update, and I've kinda made it my mission to ensure that

@nhinkle The complexity of the image probably has an effect on the issue

@allquixotic Fear not, as it's an open source project, it will be fixed quickly (in about 10 years or so!)

FF probably has a problem with the radial gradient or something

if this turns out not to be hardware related at all (though I don't see how that could be the case), one code change could fix it... if it is in fact hardware related somehow, or driver-specific, they may have to do some kind of whitelist for good drivers

@ThatBrazilianGuy I sympathize with your cynicism, I really do, but I could easily see this being considered a security issue, in which case, it will get top-level attention from Mozilla and its contributors

@Psycogeek I don't know how to monitor voltage. No built-in monitor exist. The reason I picked that one is because it had 4 isolated charging channels, unlike 2 and 2 channels that take at least 2 batteries to start charging process.

lol, I evaded SE CAPTCHA... just closed the dialog and try again D:

it's borderline security, because the only category you could put it into is DoS

o/

let's ask @rlemon his opinion

@rlemon another victim to add a data point to our bug hunt! \o/

@rlemon Yello

I have a unique situation i've been dealing with over the past few months, would like some advice on how to copy this tablet (complete image) via the usb port to my desktop

the basic idea is, run Firefox and click on the SVG link

!!tell 12377632 maybe

I'll try to help, but I'll be multitasking, as we are very busy with a high priority, potential security defect in firefox that we found mere hours ago and isn't already in mozilla bugzilla

in other words, drop everything and help save the world

@rlemon Which tablet?

ASUS sent me a dev (or QA) unit by mistake. the sn on the tablet doesn't match up with the warrenty or box so the store is saying FU and so is asus

@rlemon if it's android adb is your friend

windows 8 :/

@rlemon it's a windows 8 tablet? pro or RT?

@allquixotic Is it that critical situation? Why you call it exploit? Who would it be possible to exploit?

after months of arguing with asus support they are willing to look at it. but i want to have as much proof as possible of what they sent me. making a complete backup of the tablets os and installed programs / files is my next step

@Braiam adb?

I'd love someone sending me a FF OS device by mistake (as in, "we don't even know who you are, but here, have this phone" mistake)

and windows 8 core (not pro)

@Boris_yo having seperate channles is a start, but there is a lot more to a good charge alogrythm to get batteries to last time, not get cooked, not get overcharges, to be charged proper and all. With a voltage meter you just read the voltages of the battery. either always, or when it should be charged. then it gets rather complicated with what it should be showing.

@Boris_yo take for example, a website that has a comments section at the bottom of every story, and just so happens to let users embed images... now suddenly, everyone who's vulnerable to the issue will have a crashed browser and tons of memory pressure and CPU just from a simple image embed

@ThatBrazilianGuy unfortunately my company payed $700 for the tablet.

@rlemon so it's an x86 processor, not ARM?

correct

@rlemon in that case, pop a Linux bootable live CD in a USB CD/DVD drive, plug it into the tablet, and dd off the /dev/sda to a file on a remote USB HDD or flash drive with enough capacity

I was going to just boot into linux and dd, but then I remembered I can't just open up the tablet and mount the ssd. I need to somehow get the tablets ssd to mount via the usb port :/

ahhh snap. usb cd rom.

never thought of that