Obviously it'll make the developer more efficient to spend more time twiddling his thumbs waiting for his code to compile rather than creating a simple build performance win that allows him to, you know, spend more time improving Firefox. Not to mention all the other developers who stand to benefit from faster builds.

Can you share a link to a crash report from about:crashes? Sounds like some kind of shutdown hang getting force-killed maybe?

It's available for testing in Nightly builds at the moment.

Firefox also does a lot of media decoding in a separate process.

Google Play also limits APKs to 100MB maximum size while AABs have a higher limit.

See https://bugzilla.mozilla.org/show_bug.cgi?id=1894735#c15. It was code specifically targeting Firefox on Windows to blame.

Common Voice is part of the Mozilla Foundation, not the Mozilla Corporation responsible for shipping Firefox. I.e. what donations to Mozilla actually go towards.

Notably, MV3 extensions are now supported.

Isn't openssl included in the oss-fuzz project? If hanno caught it this quickly with his fuzzer, would seem to be surprising if they didn't also.

It is, it'll build a few fuzzers hitting different areas[0]. The important function in many of those `.c` files is `FuzzerTestOneInput` which is effectively the entrypoint for a single fuzz test.

Taking a look at x509.c[1] which I believe is the most likely to be able to reach the punnycode parser. (I am not at all familiar with the codebase). You can see that the OpenSSL fuzzer is basically doing a holistic fuzz (I assume the i2d* and d2i* functions exercise the parser), that is its just invoking key entrypoints that in theory can exercise all the rest of the functionality with the correct inputs.

Hanno's fuzzer on the other hand, is explicitly only testing the `ossl_punnycode_decode` function[3].

Given the breadth of the fuzzer, I think its very possible OSS-Fuzz just didn't hit it.

[0] https://github.com/openssl/openssl/blob/master/fuzz/

[1] https://github.com/openssl/openssl/blob/master/fuzz/x509.c

[2] https://twitter.com/hanno/status/1587775675397726209/photo/2

Given how much horse power and experience they have, this is very disappointing.

"They" who? Even since Heartbleed, the OpenSSL project is still woefully underfunded given its importance to... well, everything on the internet.

I meant OSS-fuzz, i.e. Google & co

Just because a project uses oss-fuzz, you can't assume it has good fuzz coverage. In this case, they probably should have written a specialized fuzz target for the Punycode parser. Parsers like this are easy to fuzz and such bugs are typically caught very quickly, often in mere seconds. With a more general fuzz target, it can take much longer to come up with input that triggers the bug.

Mozilla occasionally rolls out features in the current release via remote mechanisms. So it's rolling out to existing v101 installs now. I would assume that v102 will also ship with it on by default.