In today's episode of "life sucks thanks to Firefox": Firefox assumes the compositor will release shm buffers immediately. Of course this cannot be relied upon, this is completely compositor implementation-defined. KWin doesn't do it for instance.
The Firefox "fix" is to detect KWin via XDG_CURRENT_DESKTOP and blit buffers in this case. Brilliant.