The Trifecta Tech Foundation, the developer of projects such as ntpd-rs, sudo-rs, zlib-rs, and bzip2-rs, announced Firefox's transition to using the zlib-rs library for gzip compression and decompression. In addition to protecting against memory errors, switching from zlib to zlib-rs resulted in a significant performance boost—in tests, the speedup ranged from 3.3 to 32.5 times for single decoding operations and from 2.7 to 10.86 times for continuous stream decoding.
The zlib-rs library was included in Firefox release 151, but after its integration, some users encountered an issue that resulted in a crash due to out-of-bounds execution. It was noted that in Rust code, the issue resulted in a crash, while in C code, a similar situation would have resulted in silent data corruption without stopping the program. As a solution, the older zlib library was reverted to use in release 151.0.1.
The first manifestation of the problem was noticed during testing of early builds over a year ago, but it could not be reproduced on developer systems. Ultimately, after a year of testing with beta users, it was decided to enable zlib-rs in Firefox 151. After a new series of problem reports and an investigation into the pattern, it was discovered that the crash was caused by a microcode error in Intel CPUs based on the 13th and 14th generation Raptor Lake microarchitecture, related to the use of an incorrect register.
The issue occurred because the LLVM code generator used the "mov byte ptr [rsi + rdi + 1], ch" instruction when writing Huffman encoding results to memory. When executing this instruction on a Raptor Lake CPU, instead of writing 8-15 bits from the RCX register, corresponding to the CH register specified in the instruction, bits 0-7, corresponding to the CL register, were written to memory. A workaround was implemented in preparation for Firefox 152, and the patch was ported to the main zlib-rs release. Generation of the problematic instruction was observed in LLVM 22 (it is not generated in the LLVM 23 development branch).
Source: opennet.ru
