gitroo-admin/node
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
node/test
History
Exact
Joyee Cheung af5c144ebc
 deps,build,test: fix array index hash collision 
This enables v8_enable_seeded_array_index_hash and add a test for it.

Fixes: https://hackerone.com/reports/3511792

deps: V8: backport 0a8b1cdcc8b2

Original commit message:

    implement rapidhash secret generation

    Bug: 409717082
    Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: snek <snek@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#101499}

Refs: 0a8b1cdcc8
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

deps: V8: backport 185f0fe09b72

Original commit message:

    [numbers] Refactor HashSeed as a lightweight view over ByteArray

    Instead of copying the seed and secrets into a struct with value
    fields, HashSeed now stores a pointer pointing either into the
    read-only ByteArray, or the static default seed for off-heap
    HashSeed::Default() calls. The underlying storage is always
    8-byte aligned so we can cast it directly into a struct.

    Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105531}

Refs: 185f0fe09b
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

deps: V8: backport 1361b2a49d02

Original commit message:

    [strings] improve array index hash distribution

    Previously, the hashes stored in a Name's raw_hash_field for decimal
    numeric strings (potential array indices) consist of the literal
    integer value along with the length of the string. This means
    consecutive numeric strings can have consecutive hash values, which
    can lead to O(n^2) probing for insertion in the worst case when e.g.
    a non-numeric string happen to land in the these buckets.

    This patch adds a build-time flag v8_enable_seeded_array_index_hash that
    scrambles the 24-bit array-index value stored in a Name's raw_hash_field
    to improve the distribution.

    x ^= x >> kShift; x = (x * m1) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m2) & kMask;    // round 2
    x ^= x >> kShift;                          // finalize

    To decode, apply the same steps with the modular inverses of m1 and m2
    in reverse order.

    x ^= x >> kShift; x = (x * m2_inv) & kMask;    // round 1
    x ^= x >> kShift; x = (x * m1_inv) & kMask;    // round 2
    x ^= x >> kShift;                              // finalize

    where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask,
    m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv,
    m2_inv (modular inverses) are precomputed modular inverse of m1 and m2.
    The pre-computed values are appended to the hash_seed ByteArray in
    ReadOnlyRoots and accessed in generated code to reduce overhead.
    In call sites that don't already have access to the seeds, we read them
    from the current isolate group/isolate's read only roots.

    To consolidate the code that encode/decode these hashes, this patch
    adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA
    that perform seeding/unseeding if enabled, and updates places where
    encoding/decoding of array index is needed to use them.

    Bug: 477515021
    Change-Id: I350afe511951a54c4378396538152cc56565fd55
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/main@{#105596}

Refs: 1361b2a49d
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

deps: V8: cherry-pick aac14dd95e5b

Original commit message:

    [string] add 3rd round to seeded array index hash

    Since we already have 3 derived secrets, and arithmetics are
    relatively cheap, add a 3rd round to the xorshift-multiply
    seeding scheme. This brings the bias from ~3.4 to ~0.4.

    Bug: 477515021
    Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117
    Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#105824}

Refs: aac14dd95e
PR-URL: https://github.com/nodejs-private/node-private/pull/834
CVE-ID: CVE-2026-21717
2026-03-23 18:45:35 +01:00
..
abort
addons test: mark stringbytes-external-max flaky on AIX 2026-03-04 10:41:49 +01:00
async-hooks test: account for truthy signal in flaky async_hooks tests 2026-03-04 10:41:48 +01:00
benchmark test: fix typo of test-benchmark-readline.js 2025-11-19 18:31:39 +01:00
cctest path,win: fix bug in resolve and normalize 2026-03-03 15:10:37 +01:00
common doc: fix typo in test/common/README.md 2026-03-04 10:41:47 +01:00
doctool
embedding
es-module module: correctly detect top-level await in ambiguous contexts 2025-11-19 18:17:40 +01:00
fixtures deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
fuzzers
internet
js-native-api
known_issues
message
node-api
overlapped-checker
parallel tls: wrap SNICallback invocation in try/catch 2026-03-20 17:45:06 +01:00
pseudo-tty
pummel deps,build,test: fix array index hash collision 2026-03-23 18:45:35 +01:00
report
sequential test: fix flaky test-performance-eventloopdelay 2026-03-04 10:41:48 +01:00
test426
testpy
tick-processor
tools
v8-updates
wasi
wasm-allocation
wpt
.eslintrc.yaml
README.md
root.status

README.md

Node.js Core Tests

This directory contains code and data used to test the Node.js implementation.

For a detailed guide on how to write tests in this directory, see the guide on writing tests.

On how to run tests in this directory, see the contributing guide.

For the tests to run on Windows, be sure to clone Node.js source code with the autocrlf git config flag set to true.

Test Directories

Directory Runs on CI Purpose
abort Yes Tests that use --abort-on-uncaught-exception and other cases where we want to avoid generating a core file.
addons Yes Tests for addon functionality along with some tests that require an addon.
async-hooks Yes Tests for async_hooks functionality.
benchmark Yes Test minimal functionality of benchmarks.
cctest Yes C++ tests that are run as part of the build process.
code-cache No Tests for a Node.js binary compiled with V8 code cache.
common N/A Common modules shared among many tests.1
doctool Yes Tests for the documentation generator.
es-module Yes Test ESM module loading.
fixtures N/A Test fixtures used in various tests throughout the test suite.
internet No Tests that make real outbound network connections.2
js-native-api Yes Tests for Node.js-agnostic Node-API functionality.
known_issues Yes Tests reproducing known issues within the system.3
message Yes Tests for messages that are output for various conditions
node-api Yes Tests for Node.js-specific Node-API functionality.
parallel Yes Various tests that are able to be run in parallel.
pseudo-tty Yes Tests that require stdin/stdout/stderr to be a TTY.
pummel No Various tests for various modules / system functionality operating under load.
sequential Yes Various tests that must not run in parallel.
testpy N/A Test configuration utility used by various test suites.
tick-processor No Tests for the V8 tick processor integration.4
v8-updates No Tests for V8 performance integration.

  1. Documentation ↩︎

  2. Tests for networking related modules may also be present in other directories, but those tests do not make outbound connections. ↩︎

  3. All tests inside of this directory are expected to fail. If a test doesn't fail on certain platforms, those should be skipped via known_issues.status. ↩︎

  4. The tests are for the logic in lib/internal/v8_prof_processor.js and lib/internal/v8_prof_polyfill.js. The tests confirm that the profile processor packages the correct set of scripts from V8 and introduces the correct platform specific logic. ↩︎