1444292 - Firefox Nightly 60.0a1 (2018-03-08/9) (64-bit) causing kernel panic in iMac Pro1,1

Status: RESOLVED INCOMPLETE

(Core :: General, defect, P3)

Description

[Steve]

Attachment: Screen Shot 2018-03-08 at 9.47.02 PM.png

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/604.5.100 (KHTML, like Gecko) Version/11.0.3 Safari/604.5.100

Steps to reproduce:

On an iMac Pro, 10.13.3, 3.2 GHz, 64 GB Radeon Vega 64,
with Nightly 60.0a1 (2018-03-08/9)

1. Create a macOs webloc file similar to this, which points to my Synology NAS:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>URL</key>
	<string>http://quickconnect.to/sterpe</string>
</dict>
</plist>

2. Place the webloc file in ~/

3. Set Firefox Nightly as the default system browser

4. Close Firefox Nightly, fully exiting the app.

5. Open finder and navigate to ~/

6. Click on the webloc file you created in step 1

7. Repeat steps 4-7 until you get a Kernel Panic


Actual results:

Observer that when Firefox Nightly opens a macOS webloc file from Finder, that
Nightly locks up, followed by a kernel panic that crashes the iMac Pro.


Expected results:

Firefox should have opened the login page for a Synology ds416play without crashing the whole machine.

Comment 1

[Stefan [:StefanG_QA]]

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0 (20180310025718) 

I was able to reproduce the mentioned behavior on OS X 10.13 using the above steps. After starting the webloc file the whole machine has crashed/restarted.

Comment 2

[Jim Mathies [:jimm]]

Really odd bug. Stephen, can you do a little research here? Wondering what these webloc files are for.

Comment 3

[Steve]

@Jim, essentially it's a live URL that is a file on the file system.  Double-clicking the .webloc file opens the pointed-to url with the default application (the default web browser).

See https://discussions.apple.com/thread/2737934

Comment 4

[Haik Aftandilian [:haik]]

@Stefan or @Steve, do you have any logs from the kernel panic? If you open up the Console app (/Applications/Utilities/Console) and look in the "System Reports" section, you might see an entry from the kernel panic with a stack trace. In the "User Reports" section, there might be info about a Firefox crash. If there are any crash stacks, that might help us pin down what's happening.

I haven't been able to reproduce this on my MacBook Pro Retina, 15-inch, Mid 2015 running 10.13.3.

We should report the kernel panic to Apple.

Comment 6

[Steve]

Nothing in User Reports. :(

Comment 7

[Steve]

Attachment: panic-full-2018-03-16-020007.ips

Same as github gist.

Comment 8

[Steve]

Filed with bugreport.apple.com #38530345 to be sure. You all probably have better internal channels with them, I assume.

Comment 9

[Haik Aftandilian [:haik]]

Thanks, Steve. I'm marking this as a security bug for now because I noticed some of the attachments have raw stack data and that could contain your private data. As a result, to be on the safe side, I recommend changing any passwords that could have been in memory at the time of the crash. From a quick scan of the data, this looks like a generic OS X kernel bug, but it's possible that Firefox could have an issue too. I will look a bit more.

Comment 10

[Haik Aftandilian [:haik]]

(In reply to Haik Aftandilian [:haik] from comment #9)
> some of the attachments have raw stack data and that could contain your
> private data. As a result, to be on the safe side, I recommend changing any
> passwords that could have been in memory at the time of the crash.

Same applies to the github data of course.

Comment 11

[Daniel Veditz [:dveditz]]

I hid the .ips attachment and the comment linking to the same on github. The crash attachment is equivalent to what we post publicly on crash-stats.mozilla.org and should be fine. Otherwise this does not appear to be an exploitable crash so opening the bug up again.

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.

Comment 13

[Stephen A Pohl [:spohl]]

Are you still able to reproduce this issue?

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:fgriffith, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.