Trifecta Tech Foundation, which develops projects like ntpd-rs, sudo-rs, zlib-rs, and bzip2-rs, announced Firefox's transition to using the zlib-rs library for compression and decompression with the gzip method. In addition to protecting against memory-related issues, the switch from zlib to zlib-rs resulted in a significant performance boost — tests showed a speedup of 3.3 to 32.5 times for single decoding operations and 2.7 to 10.86 times for continuous stream decoding.
The zlib-rs library was utilized in the release of Firefox 151, but after its integration, some users encountered a problem that caused crashes due to out-of-bounds errors. It was noted that in Rust code, the issue led to a crash, while in C, a similar situation would result in unnoticed data corruption without halting the operation. As a solution, the old zlib library was reinstated in release 151.0.1.
The first signs of the problem were observed during testing of early builds over a year ago, but it could not be reproduced on developers' systems. Ultimately, after a year of user testing on beta releases, it was decided to activate zlib-rs in the release of Firefox 151. Following a new series of problem reports and pattern analysis, it was determined that the failure was caused by a bug in the Intel CPU microcode based on the Raptor Lake microarchitecture of the 13th and 14th generations, related to the use of an incorrect register.
The issue arose because the LLVM code generator used the instruction "mov byte ptr [rsi + rdi + 1], ch" when writing the results of Huffman encoding to memory. When this instruction was executed on the Raptor Lake CPU, instead of 8-15 bits from the RCX register that corresponded to the CH register indicated in the instruction, bits 0-7 from the CL register were written to memory. While preparing the Firefox 152 release, the bug was circumvented and the patch was incorporated into the main version of zlib-rs. The problematic instruction generation was observed in LLVM 22 (in the ongoing LLVM 23 development branch, it is not generated).
Mənbə: opennet.ru
