Mozilla Firefox

[Grogan]

Firefox is still the most useful browser, in being able to turn off annoyances and security/privacy features that get in the way, fall back to old appearances AND last but far from least, uncrippled extension interface where we can filter streams and remove unwanted rubbish and behaviour. I certainly don't want to have to use anything else.

[Grogan]

Firefox 138.0 Release Notes:
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Profile management helps protect your privacy and stay focused by separating your online life into distinct profiles — for work, school, vacation planning, or whatever you choose. You can now name your profiles and customize them with avatars and color themes for easy recognition, then quickly switch between them — all while keeping bookmarks, tabs, and browsing history completely separate.

Users in the United States can now trigger weather suggestions in the address bar! Simply type a weather-related term or a city name, and view the result directly in the address bar dropdown.

Tab Groups, a new way to organize and take control of your tabs, is now available to almost all users worldwide. You can create a group by dragging one tab onto another, pausing, then dropping it. You can also now reposition a tab group on the tab bar by dragging it.

Firefox on Windows 11 now uses acrylic-style menus for popup windows, which better match the operating system’s aesthetic.

You can now copy links from background tabs using the tabstrip context menu on MacOS and Linux.

Various security fixes.

Improved the address and credit card autofill experience to better handle forms that update dynamically as users input information. Autofill now correctly fills newly revealed fields—such as those shown after selecting a country.

Rededicated previous color settings to Contrast Control settings.

Apart from security fixes (for issues that probably wouldn't be there if they didn't induce them), this is the kind of shit we get now, never code improvements.

[Grogan]

Firefox 138.0.1 already
https://ftp.mozilla.org/pub/firefox/releases/138.0.1/

With release notes even:
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed an issue which caused a blank page to be shown for Home and New Tab pages for some users. (Bug 1963537)

Added a workaround for a bug in outlook.office.com/outlook.live.com where attachment filenames are incorrectly prefixed with UTF-8 when saved. (Bug 1961710)

I want to rebuild anyway. It didn't seem to do any harm, but I forgot to switch out my wasi-sysroot when I switched back to LLVM 19 for the build. Oops! (I'm really surprised that worked, but I guess the compiler-rt library in /usr/lib/clang/19/lib/wasi is the critical thing)

[Grogan]

Man... I'm so sick of Arch and their bullshit. Both my LLVM's (19.1.7 and 20.1.1) are broken because of updates to libxml last night which has changed sonames from libxml2.so.2 to libxml2.so.16. Fuck off... it's been .so.2 for as long as I can remember and for the distro to suddenly break it like that irks me.

Why would clang be linked against that in the first place? A compiler shouldn't have hard dependencies against libraries like that. What fragile rubbish!

Code: Select all

checking whether the target C compiler can be used... /usr/bin/clang: error while loading shared libraries: libxml2.so.2: cannot open shared object file: No such file or directory

If that was my C/C++ compiler (i.e. on a non-gnu system) I'd be dead. Absolutely dead, unable to fix libxml or anything (I'd need to install binaries to build a new LLVM). I'm going to have to compile compat libraries before I can compile Firefox now and I'm sure there are other non-distro things I've compiled that are broken now too. Both 64 and 32 bit compat libraries will be needed. Moreover, to recompile my LLVM (to fix this properly) I need... LLVM, so I really have no choice. Time wasted again, because... Arch.

[Grogan]

I seem to have fixed some graphics benchmarks by profiling this differently. I had a hunch something wasn't right there because of changes in Mesa 25.1.x (maybe related to removal of osmesa). I was using the xvfb server with software rendering for profiling this. This time I just let the profiling scripts launch a browser window in X11 and run through the tests while I sat there, hands off the mouse and keyboard, and watched.

I noticed immediately that a canvas test (ray traced colliding balls) that wasn't working correctly is now. They were just jerking across the screen again in my last build, but now that's back to working fast and fluidly.

It's possible some of it wasn't profiling right with xvfb with LIBGL_ALWAYS_SOFTWARE=true anymore and causing it to be mis-optimized.

[Grogan]

I thought maybe it was a bug in LLVM (i.e. clang LTO) causing the miscompile and consequent youtube crash. There had been 3 point releases since 20.1.1. Alas, the problem still remains with LLVM 20.1.4. It's likely to be something with the Firefox build system running afoul of changes in LLVM 20.

It doesn't happen with a plain build, and I find it more likely that something is getting broken during LTO linking rather than the profiling (which seems to work correctly). To test that theory I'm going to try a profiled build without LTO. I think that's the more significant optimization for this code base anyway.

I would try the latest Firefox 139 beta, or even trunk to see if this is still a problem, but Firefox is such a pain in the ass with user profiles and I don't want to break mine. I have a lot of UI customization and also cookies are important to me (even for sites I don't log on to... for example my DuckDuckGo preferences are all locally stored in a cookie)

P.S. Yep, the PGO only build works fine, no crashes and a few quick benchmark tests shows that it's OK. (a bit lower but I only did one run of two tests and it was decent, certainly better than a plain build). That's a good enough compromise for now, that saves me from having to revert LLVM and Rust etc. every time I want to build Firefox.

[Zema Bus]

In recent years I haven't had any issues with running two different Firefox versions each with their own profiles, they changed it some time back to make it easier to run different versions side by side. It's not like it used to be. I've been running Firefox Nightly along side my normal release build of Firefox for a while. The only reason I have Firefox Nightly is to see the upcoming changes. It has no impact on the release version I use for normal stuff. Plus you could also just back up your profile before hand to be extra safe

[Grogan]

True, but I mean I have to reconnect mine. Firefox with a new profile gives me no incentive to use it at all. I've been using this profile for many years, copied between OSes and computers. There are about:config tweaks I don't even remember, and CSS tweaks, in addition to the usual settings and site cookies etc. I should have said that it's more that I don't want to deal with it.

I know... I'll compile things, get in over my head fixing source code but I won't deal with a browser profile

Anyway, this is a good build and it doesn't really matter now. If I have to build the next release cycle like this too, I won't mind.

[Grogan]

Finally... Firefox is breaking away from the Hg (Mercurial) SCM and hosting on github.

https://github.com/mozilla-firefox/firefox

That is going to make it so much easier. I'll be able to watch different branches from the same UI, view, checkout and revert commits etc. It's also much easier to get involved in reporting bugs, using the "Issues" interface on github. It's a single sign-in too, I can participate in any project on github, already logged in.

Say what you want about Microsoft, I was disgusted at first when they bought it, but github has the best UI (web interface), is the most responsive, has the fastest downloads (clone, pull, checkout) and has the least downtime. I have yet to ever have a checkout stall, unlike gitlab instances or self hosted git repos. Microsoft is demonstrably managing it well.

[Zema Bus]

That's good!

[Grogan]

Firefox 138.0.3 today (they skipped .2) with release notes even:
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed a crash that could occur when viewing websites that use WebGL. (Bug 1961191)

Fixed an issue where the browser could repeatedly crash when certain SVG effects (like blur or drop shadow) were applied to very small areas. (Bug 1924241)

On Linux, fixed an issue where video playback would appear washed-out on Wayland when HDR support was unavailable. (Bug 1961610)

Fixed an issue where the "Match Case" shortcut Alt+C in the find-in-page toolbar did not toggle the checkbox as expected. (Bug 1952611)

[Grogan]

Jeeze... there's a Firefox 138.0.4 now. With release notes:
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Security Fixes

https://www.mozilla.org/en-US/security/ ... sa2025-36/

#CVE-2025-4918: Out-of-bounds access when resolving Promise objects

Reporter
Edouard Bochin and Tao Yan from Palo Alto Networks working with Trend Micro's Zero Day Initiative
Impact
critical

Description

An attacker was able to perform an out-of-bounds read or write on a JavaScript Promise object.
References

Bug 1966612

#CVE-2025-4919: Out-of-bounds access when optimizing linear sums

Reporter
Manfred Paul working with Trend Micro's Zero Day Initiative
Impact
critical

Description

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.
References

Bug 1966614

Ah well, I upgraded to Rust 1.87 last night and want to do a test build anyway.

[Grogan]

Firefox 139.0 today. No release notes
https://ftp.mozilla.org/pub/firefox/releases/139.0/

I heard crowing that it was going to have faster http3 protocols, but that's irrelevant to me at this time.

P.S. Release Notes now:
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

[Grogan]

The problem with LLVM 20.x and LTO seems to be fixed now. I got a good PGO+LTO build with LLVM 20.1.5/Rust 1.87 and it's not crashing on youtube. It was instantly reproducible, so I know this has got it. Now for some benchmarks.

[Grogan]

Firefox 139.0.1 now. It's been a whole 3 days
https://www.mozilla.org/en-US/firefox/1 ... easenotes/

Fixed graphics corruption with certain NVIDIA graphics adapters and multiple monitors running at mixed refresh rates after updating to Firefox 139. (Bug 1968876)

I'd skip this, but I wouldn't mind testing a build (upgraded LLVM and related toolchains yesterday).

[Zema Bus]

I got that one on my work machine tonight, I check it after work to get any updates done so that it doesn't delay me signing into work the next day.

[Grogan]

On Windows? At least Firefox updates don't break anything (or everything). It's pretty seamless.

[Grogan]

Lately, if I leave Firefox open and walk away, when DPMS kicks in, I get these errors logged (dmesg/kernel.log)

Code: Select all

[ 5078.688126] amdgpu 0000:03:00.0: [drm] *ERROR* dpcd_set_link_settings:1118: core_link_write_dpcd (DP_DOWNSPREAD_CTRL) failed
[ 5078.707962] amdgpu 0000:03:00.0: [drm] *ERROR* dpcd_set_link_settings:1123: core_link_write_dpcd (DP_LANE_COUNT_SET) failed
[ 5078.727689] amdgpu 0000:03:00.0: [drm] *ERROR* dpcd_set_link_settings:1151: core_link_write_dpcd (DP_LINK_BW_SET) failed
[ 5079.211691] amdgpu 0000:03:00.0: [drm] *ERROR* dpcd_set_link_settings:1118: core_link_write_dpcd (DP_DOWNSPREAD_CTRL) failed
[ 5079.231478] amdgpu 0000:03:00.0: [drm] *ERROR* dpcd_set_link_settings:1123: core_link_write_dpcd (DP_LANE_COUNT_SET) failed
[ 5079.251198] amdgpu 0000:03:00.0: [drm] *ERROR* dpcd_set_link_settings:1151: core_link_write_dpcd (DP_LINK_BW_SET) failed

It's obviously harmless and I've seen them before, but I've just recently connected it to Firefox and display power management.