gitroo-admin/node
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
node/deps/v8
History
Exact
Joyee Cheung af5c144ebc
 deps,build,test: fix array index hash collision 
This enables v8_enable_seeded_array_index_hash and add a test for it.

Fixes: https://hackerone.com/reports/3511792

deps: V8: backport 0a8b1cdcc8b2

Original commit message:

    implement rapidhash secret generation

    Bug: 409717082
    Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: snek <snek@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#101499}

Refs: 0a8b1cdcc8
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

deps: V8: backport 185f0fe09b72

Original commit message:

    [numbers] Refactor HashSeed as a lightweight view over ByteArray

    Instead of copying the seed and secrets into a struct with value
    fields, HashSeed now stores a pointer pointing either into the
    read-only ByteArray, or the static default seed for off-heap
    HashSeed::Default() calls. The underlying storage is always
    8-byte aligned so we can cast it directly into a struct.

    Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105531}

Refs: 185f0fe09b
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

deps: V8: backport 1361b2a49d02

Original commit message:

    [strings] improve array index hash distribution

    Previously, the hashes stored in a Name's raw_hash_field for decimal
    numeric strings (potential array indices) consist of the literal
    integer value along with the length of the string. This means
    consecutive numeric strings can have consecutive hash values, which
    can lead to O(n^2) probing for insertion in the worst case when e.g.
    a non-numeric string happen to land in the these buckets.

    This patch adds a build-time flag v8_enable_seeded_array_index_hash that
    scrambles the 24-bit array-index value stored in a Name's raw_hash_field
    to improve the distribution.

    x ^= x >> kShift; x = (x * m1) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m2) & kMask;    // round 2
    x ^= x >> kShift;                          // finalize

    To decode, apply the same steps with the modular inverses of m1 and m2
    in reverse order.

    x ^= x >> kShift; x = (x * m2_inv) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m1_inv) & kMask;    // round 2
    x ^= x >> kShift;                              // finalize

    where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask,
    m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv,
    m2_inv (modular inverses) are precomputed modular inverse of m1 and m2.
    The pre-computed values are appended to the hash_seed ByteArray in
    ReadOnlyRoots and accessed in generated code to reduce overhead.
    In call sites that don't already have access to the seeds, we read them
    from the current isolate group/isolate's read only roots.

    To consolidate the code that encode/decode these hashes, this patch
    adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA
    that perform seeding/unseeding if enabled, and updates places where
    encoding/decoding of array index is needed to use them.

    Bug: 477515021
    Change-Id: I350afe511951a54c4378396538152cc56565fd55
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105596}

Refs: 1361b2a49d
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

deps: V8: cherry-pick aac14dd95e5b

Original commit message:

    [string] add 3rd round to seeded array index hash

    Since we already have 3 derived secrets, and arithmetics are
    relatively cheap, add a 3rd round to the xorshift-multiply
    seeding scheme. This brings the bias from ~3.4 to ~0.4.

    Bug: 477515021
    Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117
    Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105824}

Refs: aac14dd95e
PR-URL: https://github.com/nodejs-private/node-private/pull/834
CVE-ID: CVE-2026-21717
2026-03-23 18:45:35 +01:00
..
.github
base/trace_event/common deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
bazel deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
build_overrides deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
custom_deps
docs
gni deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
include src,lib: refactor unsafe buffer creation to remove zero-fill toggle 2026-01-09 11:44:02 -03:00
infra deps: patch V8 to 11.3.244.8 2023-05-02 09:33:55 +02:00
samples
src deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
test deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
testing
third_party deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
tools deps: V8: cherry-pick a0d0d4fc4f19 2025-11-19 18:01:40 +01:00
.bazelrc
.clang-format
.clang-tidy
.editorconfig
.flake8
.git-blame-ignore-revs deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
.gitattributes
.gitignore deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
.gn
.mailmap
.style.yapf deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
.vpython3 deps: update V8 to 10.8.168.20 2022-11-19 09:11:32 +00:00
.ycm_extra_conf.py deps: update V8 to 10.9.194.4 2022-11-27 17:27:13 +00:00
AUTHORS deps: V8: backport 6a0a25abaed3 2026-03-04 10:41:49 +01:00
BUILD.bazel deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
BUILD.gn deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
CODE_OF_CONDUCT.md
codereview.settings
COMMON_OWNERS deps: update V8 to 10.8.168.20 2022-11-19 09:11:32 +00:00
DEPS deps: V8: backport 2e4c5cf9b112 2025-11-13 12:08:31 +00:00
DIR_METADATA
ENG_REVIEW_OWNERS deps: update V8 to 10.8.168.20 2022-11-19 09:11:32 +00:00
INFRA_OWNERS
INTL_OWNERS
LICENSE
LICENSE.fdlibm
LICENSE.strongtalk
LICENSE.v8
LOONG_OWNERS
MIPS_OWNERS
OWNERS deps: update V8 to 10.9.194.4 2022-11-27 17:27:13 +00:00
PPC_OWNERS deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
PRESUBMIT.py deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
README.md
RISCV_OWNERS
S390_OWNERS deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
WATCHLISTS deps: update V8 to 11.3.244.4 2023-03-31 14:15:23 +00:00
WORKSPACE

README.md

V8 JavaScript Engine

V8 is Google's open source JavaScript engine.

V8 implements ECMAScript as specified in ECMA-262.

V8 is written in C++ and is used in Google Chrome, the open source browser from Google.

V8 can run standalone, or can be embedded into any C++ application.

V8 Project page: https://v8.dev/docs

Getting the Code

Checkout depot tools, and run

    fetch v8

This will checkout V8 into the directory v8 and fetch all of its dependencies. To stay up to date, run

    git pull origin
    gclient sync

For fetching all branches, add the following into your remote configuration in .git/config:

    fetch = +refs/branch-heads/*:refs/remotes/branch-heads/*
    fetch = +refs/tags/*:refs/tags/*

Contributing

Please follow the instructions mentioned at v8.dev/docs/contribute.