# Firefox 158.0.1 canonical-pointer test package

Test candidate for [oi-userland PR28058](https://github.com/OpenIndiana/oi-userland/pull/28058).
It restores the round trip of packed WebAssembly TypeDef pointers on Solaris
amd64. It is defensive: OI's packaged low-address policy still matters for the
rest of Gecko. There is no graphics or kernel package in this archive.

Kit: https://dlc.openindiana.org/isos/hipster/test/firefox-wasm-pointer-fix-20261024/

## 1. Record the baseline

Start from your working recovery BE, with exactly one `NR` entry and no `T`
entry in `beadm list`. Record its name on paper and make sure you can select
it from the console boot menu if the test BE fails. Keep both BEs afterward.

As root, collect:

```sh
beadm list
uname -v
pkg list -Hv web/browser/firefox system/kernel system/library
echo '_userlimit/J' | mdb -k
cat /etc/system.d/reserve_bits_for_tagged_pointers
grep -n _userlimit /etc/system /etc/system.d/.self-assembly
```

The packaged snippet normally contains `set _userlimit=0x7fffc0000000` and
the live value should be `7fffc0000000`. The kernel reads `.self-assembly`
before `/etc/system`: look for later `set _userlimit=...` lines in
`/etc/system`, including repeated settings. Files on disk and the live kernel
value are separate evidence. Missing files or a different live value are useful
to report. Do not change these settings during the initial package comparison.

This guide starts with stock Firefox **158.0.1 revision 0**. If you have a
different Firefox version or an already-patched package, stop and post the
version/plan on the PR rather than downgrading or forcing a solver result.

## 2. Download and verify

As your normal user:

```sh
mkdir -p /var/tmp/firefox-wasm-test
cd /var/tmp/firefox-wasm-test
curl -fLO https://dlc.openindiana.org/isos/hipster/test/firefox-wasm-pointer-fix-20261024/firefox-158.0.1-rev1-wasm-pointer-fix-20261024.p5p
curl -fLO https://dlc.openindiana.org/isos/hipster/test/firefox-wasm-pointer-fix-20261024/firefox-158.0.1-rev1-wasm-pointer-fix-20261024.p5p.sha256sum
curl -fLO https://dlc.openindiana.org/isos/hipster/test/firefox-wasm-pointer-fix-20261024/wasm-smoke.html
ACTUAL=$(digest -a sha256 firefox-158.0.1-rev1-wasm-pointer-fix-20261024.p5p) &&
EXPECTED=$(awk 'NR == 1 { print $1 }' firefox-158.0.1-rev1-wasm-pointer-fix-20261024.p5p.sha256sum) &&
[ "${#ACTUAL}" -eq 64 ] && [ "$ACTUAL" = "$EXPECTED" ] && echo 'CHECKSUM OK'
```

Continue only if `CHECKSUM OK` appears. Expected package SHA-256:
`f0100e56f33bbe65ed758a1d1f03db5bb102659c1da0f950db4e740b0374e371`.

## 3. Create and mount a new BE

As root, keep this shell open through installation. Substitute the original
BE name from step 1 and choose a new, unused test BE name/mountpoint:

```sh
ORIG='your-working-BE-name'
TESTBE='firefox-wasm-20261024'
M=/mnt/firefox-wasm-20261024
beadm list "$ORIG"
mkdir "$M" && beadm create "$TESTBE" && beadm mount "$TESTBE" "$M" && echo READY
```

The original must be `NR`, and the final command must print `READY`.
Stop on any error; do not reuse an existing BE or mount directory.

## 4. Preview and install only Firefox in the mounted BE

Preview the single version-lock facet. It must change only that facet, with
no package version changes, additions or removals. IPS may display the existing
`consolidation/userland/userland-incorporation` under “Packages to change” while
re-evaluating its conditional dependency; its FMRI must remain unchanged. No
other package may be affected. If that is the plan, apply the facet:

```sh
pkg -R "$M" change-facet -nv --deny-new-be --no-backup-be --no-be-activate \
    facet.version-lock.web/browser/firefox=false
pkg -R "$M" change-facet -v --deny-new-be --no-backup-be --no-be-activate \
    facet.version-lock.web/browser/firefox=false
pkg -R "$M" install -nv --deny-new-be --no-backup-be --no-be-activate \
    -g /var/tmp/firefox-wasm-test/firefox-158.0.1-rev1-wasm-pointer-fix-20261024.p5p \
    'pkg://openindiana.org/web/browser/firefox@158.0.1,5.11-2026.0.0.1:20261024T164848Z'
```

The install preview must change **only web/browser/firefox**, from 158.0.1
revision 0 to revision 1. Stop if it changes another package, creates a BE,
reports nothing to do, or cannot solve dependencies. Do not change publishers,
other facets, incorporations or OS versions to force installation. Save the plan.

If that one-package plan is correct, install and verify:

```sh
pkg -R "$M" install -v --deny-new-be --no-backup-be --no-be-activate \
    -g /var/tmp/firefox-wasm-test/firefox-158.0.1-rev1-wasm-pointer-fix-20261024.p5p \
    'pkg://openindiana.org/web/browser/firefox@158.0.1,5.11-2026.0.0.1:20261024T164848Z'
pkg -R "$M" verify -v web/browser/firefox
pkg -R "$M" list -Hv web/browser/firefox
beadm unmount "$TESTBE"
```

Require exit 0 for installation, verification and unmounting, and the exact
FMRI above. Do not proceed after an error.

## 5. Boot the test BE deliberately

This is permanent activation, as with the corrected Xorg rev18 manual; there
is **no automatic rollback**. No temporary activation flags are used.

```sh
beadm activate "$TESTBE"
echo "activation exit=$?"
beadm list
```

Require activation exit 0, original BE `N`, test BE `R`, and no `T` marker.
Only then save your work and run `reboot -p`. If the test BE cannot boot, use
the console boot menu to select the original BE, then activate that original
BE and verify it is `NR`. A reset alone keeps trying the test default.

## 6. Test with a fresh profile

After boot, require the test BE to be `NR`. Record the step 1 commands again,
including the **live** `_userlimit`. As your ordinary desktop user:

```sh
PROFILE=$(mktemp -d "$HOME/firefox-wasm-test.XXXXXX")
firefox --no-remote --profile "$PROFILE" file:///var/tmp/firefox-wasm-test/wasm-smoke.html
```

Homes are commonly shared across BEs. Use only this new profile for the test;
do not reuse or migrate your normal profile. The page should show `PASS` for
100 WebAssembly instantiations. Close Firefox, relaunch with the same temporary
profile, and repeat several times. Report whether startup is immediate/reliable
and whether the ordinary browser UI works.

If the live `_userlimit` is low, success is regression coverage only. If your
existing configuration still produces high mappings, a successful patched run
is particularly useful; report that distinction. Do not deliberately remove the
packaged workaround or add a high limit to force this first trial: this patch
does not establish unrestricted high-address support throughout Gecko.

## 7. Return to the original BE

As root, set `ORIG` again from your paper, then:

```sh
beadm list
beadm activate "$ORIG"
echo "activation exit=$?"
beadm list
```

Require activation exit 0, original BE `R` and test BE `N` before `reboot -p`.
After returning, require original BE `NR`. If already booted into the original
via the console menu, activation should leave it `NR`; no extra reboot is needed.
Stop on activation errors even if the flags look plausible. Keep both BEs.

## Report on PR28058

Please include baseline/test Firefox FMRIs, `uname -v`, BE names/markers,
live `_userlimit` before/after, the relevant setting lines, install dry-run
changes, startup frequency and the smoke-page result. A low-address pass is
useful but does not close the high-address case.

If another crash occurs, report only the signal and stack frames initially.
Do not attach cores, memory dumps, profile files, cookies or browsing content
to GitHub. No crash-report upload is required by this test.

## Build and validation

Source: `7009cddcf9c84cae6e3fa6ed2981b757bab9198f`.
Validation receipt, 2026-10-24, all native on OpenIndiana amd64:

- Native build: oi-userland head 7009cddcf9c84cae6e3fa6ed2981b757bab9198f (branch fix/firefox-wasm-canonical-pointers-20261024, base 0b3910eefcd88b398dea900f0b146aa8a3e78142) in the non-global build zone `oibuild` (Hipster 2026.04, illumos-5400c85432) under an ordinary build account with an explicit two-job limit. `gmake build`, `gmake install` and `gmake publish` each exited 0. The patched `js/src/wasm/WasmValType.h` in the build tree matches the independently reviewed fixture header byte for byte (SHA-256 c2819b460b3c71a4d8fc6fffe3c0ee59a55555591518bc36bdec923bcab2bfe1).
- Package: pkg://openindiana.org/web/browser/firefox@158.0.1,5.11-2026.0.0.1:20261024T164848Z, exported alone from the build repository with pkgrecv -a. Its manifest records the Git remote, branch and revision above. The archive contains no other package.
- SpiderMonkey shell from the same build: 100 WebAssembly module/instance constructions returned 42 (runtime-wasm-smoke.js), exit 0.
- Headless browser: the build tree's dist/bin/firefox was started three times with --headless --no-remote and a new task-owned profile (offline prefs, local-only proxy) against wasm-smoke.html. Each run exited 0 within the 60 s bound and the captured screenshot shows `PASS: 100 WebAssembly instantiations returned 42.` This ran inside the build zone from the build tree, not from the installed package in a booted boot environment.
- Installation: in a root-owned disposable alternate-root IPS image (stock Firefox 158.0.1 revision 0, `entire`, userland-incorporation 35168, Firefox version lock facet already relaxed as in the manual), the parsable install plan changed exactly web/browser/firefox from revision 0 to revision 1 with no package additions or removals and no facet, variant, mediator, service or boot-environment changes. Installation exited 0, `pkg verify -v` reported OK for Firefox and the incorporation, and the publisher list was unchanged. No boot environment was booted and no running system's packages were changed.
- Limits: the build zone and the fixture host both enforce the packaged low `_userlimit` (a bounded high-address mmap returns ENOMEM), so the high-address process layout from the reported crash cannot be reproduced on these hosts. The results above are regression coverage of the patched decoder in a low-address layout; recovery in the high-address layout still needs tester acceptance. The patch changes one decoder and does not establish that all Gecko pointer representations support unrestricted high user addresses.
- wasm-smoke.html was changed after review r1 to construct the module and instance synchronously, so a headless screenshot captures the result; its SHA-256 is listed in SHA256SUMS.