1149814 - Mac OS X Kernel Panic

Status: RESOLVED WORKSFORME

(Core :: Audio/Video: Playback, defect, P1)

Description

[Marc Andrysco]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0
Build ID: 20150306140302

Steps to reproduce:

We ran a fuzz testing tool that simultaneously plays hundreds of MP4 video files using the video tag.

Source code on github: https://github.com/marcandrysco/CSE227-Project


Actual results:

Mac OS X kernel panic.


Expected results:

No kernel panic.

Comment 1

[:Gijs (he/him)]

Can you provide more info (dumps etc.) from the kernel panic? Have you reported this to Apple?

Comment 2

[Eric Seidel]

Attachment: macos-kernel-panic-1.txt

Comment 3

[Eric Seidel]

Attachment: macos-kernel-panic-2.txt

Comment 4

[Eric Seidel]

Attachment: macos-kernel-panic-3.txt

Comment 5

[Eric Seidel]

Attachment: macos-kernel-panic-4.txt

Comment 6

[Eric Seidel]

Attachment: macos-kernel-panic-5.txt

Comment 7

[Eric Seidel]

I just added the 5 kernel dumps we were able to collect. As you'll see, it varies between a page fault and a general protection fault, but always in Apple's video decoder process. Furthermore, the kernel panic doesn't happen until we have at least 400 or so corrupted MP4s playing simultaneously, so we suspect there may be a race condition involved.

We have not submitted a bug report to Apple yet, as we weren't able to trigger the panic from any other browser.

Comment 8

[Jean-Yves Avenard [:jya]]

wait what? "User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0
Build ID: 20150306140302"

is this linux or is it OSX ?

And which version of OS X ?
Maybe that bug should be send to apple instead. Not much we can do there.

Comment 9

[Al Billings [:abillings - ex-MoCo]]

(In reply to Jean-Yves Avenard [:jya] from comment #8)
> wait what? "User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:36.0)
> Gecko/20100101 Firefox/36.0
> Build ID: 20150306140302"

Bugzilla just defaults to the UA string of the browser used to report this. This data is often useless.

Comment 10

[Daniel Veditz [:dveditz]]

Anthony: why does this block the MSE bug? The linked fuzzer doesn't appear to use MediaSource in any way.

Comment 11

[Daniel Veditz [:dveditz]]

Marc: do you have any clues which video(s) were being played when you got the kernel panics?

Comment 12

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

(In reply to Daniel Veditz [:dveditz] from comment #10)
> Anthony: why does this block the MSE bug? The linked fuzzer doesn't appear
> to use MediaSource in any way.

The blocking MSE flag is used to track bugs that do/could break MSE.

Comment 13

[Matt Wobensmith [:mwobensmith][:matt:]]

Marc, can you file a bug with Apple regardless? Even if it turns out to be something we can address in Firefox, the fact that it happens in Apple's video decoder process would be something that would concern them.

Comment 14

[Eric Seidel]

I've filed a bug with Apple (#20557141, but I'm guessing it won't be publicly visible).

I'm not convinced there's a specific video that causes the panic, rather it appears to be a race condition. We initially got the panic after loading a page with around 1000 MP4s playing. I tried to narrow down the source by playing one video at a time, but could not reproduce the panic. Then I tried adding videos to the page incrementally, and was able to reproduce the panic consistently once about 420 videos were playing simultaneously (the selection of videos did not seem to matter).

Comment 15

[Chris Peterson [:cpeterson]]

Jean-Yves, do you think this kernel panic is related to the VideoToolbox crash in bug 1187103 (fixed by bug 1061525)?

Comment 16

[Jean-Yves Avenard [:jya]]

could be... it's hard to say really.

the symptoms are extremely different so while it's certainly a bug in Apple's VideoToolbox ; I doubt it's the same.

Comment 17

[Jean-Yves Avenard [:jya]]

Not an MSE issue ; and I'm assuming the problem with the RGBA VT bug which we now avoid