The Trifecta Tech Foundation, which develops projects like ntpd-rs, sudo-rs, zlib-rs, and bzip2-rs, has announced Firefox's transition to using the zlib-rs library for compression and decompression with the gzip method. In addition to protecting against issues caused by memory management errors, the switch from zlib to zlib-rs has led to a significant performance boost — in tests conducted, the acceleration ranged from 3.3 to 32.5 times for single decoding operations and from 2.7 to 10.86 times for continuous stream decoding.
The zlib-rs library was utilized in the release of Firefox 151, but after its integration, some users encountered an issue that led to crashes due to out-of-bounds access. It is noted that in Rust code, this problem caused crashes, whereas in C a similar situation would lead to unnoticed data corruption without stopping execution. As a solution, the old zlib library was reinstated in release 151.0.1.
The first manifestation of the issue was observed during testing of early builds over a year ago, but developers were unable to reproduce it on their systems. Ultimately, after a year of testing on beta users, it was decided to activate zlib-rs in the release of Firefox 151. Following a new series of problem reports and analysis of the patterns, it was determined that the failure was caused by a microcode error in Intel CPUs based on the Raptor Lake microarchitecture of the 13th and 14th generations, related to the use of an incorrect register.
The problem arose because the LLVM code generator used the instruction "mov byte ptr [rsi + rdi + 1], ch" when writing Huffman encoding results to memory. When executing this instruction on Raptor Lake CPUs, instead of 8-15 bits from the RCX register corresponding to the CH register specified in the instruction, bits 0-7 from the CL register were written to memory. In preparing the Firefox 152 release, the error was circumvented and the patch was incorporated into the main zlib-rs codebase. The problematic instruction generation was noticed in LLVM 22 (it is not generated in the development branch of LLVM 23).
Source: opennet.ru
