Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 7ab253f

Browse filesBrowse files
hashseedMylesBorins
hashseed
authored and
MylesBorins
committed
deps: V8: cherry-pick 64-bit hash seed commits
This serves as mitigation for the so-called HashWick vulnerability. Original commit messages: commit d5686a74d56fbb6985b22663ddadd66eb7b91519 Author: Yang Guo <yangguo@chromium.org> Date: Mon Jul 16 11:19:42 2018 Extend hash seed to 64 bits R=bmeurer@chromium.org, ulan@chromium.org Bug: chromium:680662 Change-Id: I5e1486ad2a42db2998d5485a0c4e711378678e6c Reviewed-on: https://chromium-review.googlesource.com/1136034 Reviewed-by: Marja Hölttä <marja@chromium.org> Reviewed-by: Ulan Degenbaev <ulan@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#54460} commit 3833fef57368c53c6170559ffa524c8c69f16ee5 Author: Yang Guo <yangguo@chromium.org> Date: Thu Sep 20 11:43:13 2018 Refactor integer hashing function names We now clearly differentiate between: - unseeded hash for 32-bit integers - unseeded hash for 64-bit integers - seeded hash for 32-bit integers - seeded hash for strings R=bmeurer@chromium.org Bug: chromium:680662 Change-Id: I7459958c4158ee3501c962943dff8f33258bb5ce Reviewed-on: https://chromium-review.googlesource.com/1235973 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56068} commit 95a979e02d7154e45b293261a6998c99d71fc238 Author: Yang Guo <yangguo@chromium.org> Date: Thu Sep 20 14:34:48 2018 Call into C++ to compute seeded integer hash R=bmeurer@chromium.org Bug: chromium:680662 Change-Id: I8dace89d576dfcc5833fd539ce698a9ade1cb5a0 Reviewed-on: https://chromium-review.googlesource.com/1235928 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56091} commit 2c2af0022d5feb9e525a00a76cb15db9f3e38dba Author: Yang Guo <yangguo@chromium.org> Date: Thu Sep 27 16:37:57 2018 Use 64-bit for seeded integer hashes R=petermarshall@chromium.org Bug: chromium:680662 Change-Id: If48d1043dbe1e1bb695ec890c23e103a6cacf2d4 Reviewed-on: https://chromium-review.googlesource.com/1244220 Commit-Queue: Yang Guo <yangguo@chromium.org> Reviewed-by: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#56271} Refs: #23259 PR-URL: #23274 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent 104fbc6 commit 7ab253f
Copy full SHA for 7ab253f
Expand file treeCollapse file tree

36 files changed

+180
-128
lines changed
Open diff view settings
Collapse file

‎deps/v8/include/v8-version.h‎

Copy file name to clipboardExpand all lines: deps/v8/include/v8-version.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 6
1212
#define V8_MINOR_VERSION 2
1313
#define V8_BUILD_NUMBER 414
14-
#define V8_PATCH_LEVEL 68
14+
#define V8_PATCH_LEVEL 69
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)
Collapse file

‎deps/v8/src/assembler.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/assembler.cc
+10Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1432,6 +1432,16 @@ ExternalReference ExternalReference::check_object_type(Isolate* isolate) {
14321432
return ExternalReference(Redirect(isolate, FUNCTION_ADDR(CheckObjectType)));
14331433
}
14341434

1435+
static uint32_t ComputeSeededIntegerHash(Isolate* isolate, uint32_t key) {
1436+
DisallowHeapAllocation no_gc;
1437+
return ComputeSeededHash(key, isolate->heap()->HashSeed());
1438+
}
1439+
1440+
ExternalReference ExternalReference::compute_integer_hash(Isolate* isolate) {
1441+
return ExternalReference(
1442+
Redirect(isolate, FUNCTION_ADDR(ComputeSeededIntegerHash)));
1443+
}
1444+
14351445
#ifdef V8_INTL_SUPPORT
14361446
ExternalReference ExternalReference::intl_convert_one_byte_to_lower(
14371447
Isolate* isolate) {
Collapse file

‎deps/v8/src/assembler.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/assembler.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -979,7 +979,7 @@ class ExternalReference BASE_EMBEDDED {
979979
static ExternalReference try_internalize_string_function(Isolate* isolate);
980980

981981
static ExternalReference check_object_type(Isolate* isolate);
982-
982+
static ExternalReference compute_integer_hash(Isolate* isolate);
983983
#ifdef V8_INTL_SUPPORT
984984
static ExternalReference intl_convert_one_byte_to_lower(Isolate* isolate);
985985
static ExternalReference intl_to_latin1_lower_table(Isolate* isolate);
Collapse file

‎deps/v8/src/ast/ast-value-factory.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/ast/ast-value-factory.cc
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,6 @@ bool AstValue::BooleanValue() const {
202202
UNREACHABLE();
203203
}
204204

205-
206205
void AstValue::Internalize(Isolate* isolate) {
207206
switch (type_) {
208207
case STRING:
Collapse file

‎deps/v8/src/ast/ast-value-factory.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/ast/ast-value-factory.h
+5-5Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -361,7 +361,7 @@ class AstValue : public ZoneObject {
361361

362362
class AstStringConstants final {
363363
public:
364-
AstStringConstants(Isolate* isolate, uint32_t hash_seed)
364+
AstStringConstants(Isolate* isolate, uint64_t hash_seed)
365365
: zone_(isolate->allocator(), ZONE_NAME),
366366
string_table_(AstRawString::Compare),
367367
hash_seed_(hash_seed) {
@@ -391,15 +391,15 @@ class AstStringConstants final {
391391
STRING_CONSTANTS(F)
392392
#undef F
393393

394-
uint32_t hash_seed() const { return hash_seed_; }
394+
uint64_t hash_seed() const { return hash_seed_; }
395395
const base::CustomMatcherHashMap* string_table() const {
396396
return &string_table_;
397397
}
398398

399399
private:
400400
Zone zone_;
401401
base::CustomMatcherHashMap string_table_;
402-
uint32_t hash_seed_;
402+
uint64_t hash_seed_;
403403

404404
#define F(name, str) AstRawString* name##_string_;
405405
STRING_CONSTANTS(F)
@@ -418,7 +418,7 @@ class AstStringConstants final {
418418
class AstValueFactory {
419419
public:
420420
AstValueFactory(Zone* zone, const AstStringConstants* string_constants,
421-
uint32_t hash_seed)
421+
uint64_t hash_seed)
422422
: string_table_(string_constants->string_table()),
423423
values_(nullptr),
424424
strings_(nullptr),
@@ -535,7 +535,7 @@ class AstValueFactory {
535535

536536
Zone* zone_;
537537

538-
uint32_t hash_seed_;
538+
uint64_t hash_seed_;
539539

540540
#define F(name) AstValue* name##_;
541541
OTHER_CONSTANTS(F)
Collapse file

‎deps/v8/src/builtins/builtins-collections-gen.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/builtins/builtins-collections-gen.cc
+5-6Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ class CollectionsBuiltinsAssembler : public CodeStubAssembler {
9292
Node* key_tagged, Variable* result,
9393
Label* entry_found,
9494
Label* not_found);
95-
Node* ComputeIntegerHashForString(Node* context, Node* string_key);
95+
Node* ComputeStringHash(Node* context, Node* string_key);
9696
void SameValueZeroString(Node* context, Node* key_string, Node* candidate_key,
9797
Label* if_same, Label* if_not_same);
9898

@@ -515,8 +515,7 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForSmiKey(
515515
Node* table, Node* smi_key, Variable* result, Label* entry_found,
516516
Label* not_found) {
517517
Node* const key_untagged = SmiUntag(smi_key);
518-
Node* const hash =
519-
ChangeInt32ToIntPtr(ComputeIntegerHash(key_untagged, Int32Constant(0)));
518+
Node* const hash = ChangeInt32ToIntPtr(ComputeUnseededHash(key_untagged));
520519
CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
521520
result->Bind(hash);
522521
FindOrderedHashTableEntry<CollectionType>(
@@ -531,7 +530,7 @@ template <typename CollectionType>
531530
void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForStringKey(
532531
Node* context, Node* table, Node* key_tagged, Variable* result,
533532
Label* entry_found, Label* not_found) {
534-
Node* const hash = ComputeIntegerHashForString(context, key_tagged);
533+
Node* const hash = ComputeStringHash(context, key_tagged);
535534
CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
536535
result->Bind(hash);
537536
FindOrderedHashTableEntry<CollectionType>(
@@ -573,8 +572,8 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForOtherKey(
573572
result, entry_found, not_found);
574573
}
575574

576-
Node* CollectionsBuiltinsAssembler::ComputeIntegerHashForString(
577-
Node* context, Node* string_key) {
575+
Node* CollectionsBuiltinsAssembler::ComputeStringHash(Node* context,
576+
Node* string_key) {
578577
VARIABLE(var_result, MachineType::PointerRepresentation());
579578

580579
Label hash_not_computed(this), done(this, &var_result);
Collapse file

‎deps/v8/src/code-stub-assembler.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/code-stub-assembler.cc
+27-17Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -200,10 +200,6 @@ HEAP_CONSTANT_LIST(HEAP_CONSTANT_ACCESSOR);
200200
HEAP_CONSTANT_LIST(HEAP_CONSTANT_TEST);
201201
#undef HEAP_CONSTANT_TEST
202202

203-
Node* CodeStubAssembler::HashSeed() {
204-
return LoadAndUntagToWord32Root(Heap::kHashSeedRootIndex);
205-
}
206-
207203
Node* CodeStubAssembler::StaleRegisterConstant() {
208204
return LoadRoot(Heap::kStaleRegisterRootIndex);
209205
}
@@ -5389,22 +5385,32 @@ template void CodeStubAssembler::NameDictionaryLookup<NameDictionary>(
53895385
template void CodeStubAssembler::NameDictionaryLookup<GlobalDictionary>(
53905386
Node*, Node*, Label*, Variable*, Label*, int, LookupMode);
53915387

5392-
Node* CodeStubAssembler::ComputeIntegerHash(Node* key) {
5393-
return ComputeIntegerHash(key, IntPtrConstant(kZeroHashSeed));
5394-
}
5395-
5396-
Node* CodeStubAssembler::ComputeIntegerHash(Node* key, Node* seed) {
5397-
// See v8::internal::ComputeIntegerHash()
5388+
Node* CodeStubAssembler::ComputeUnseededHash(Node* key) {
5389+
// See v8::internal::ComputeUnseededHash()
53985390
Node* hash = TruncateWordToWord32(key);
5399-
hash = Word32Xor(hash, seed);
5400-
hash = Int32Add(Word32Xor(hash, Int32Constant(0xffffffff)),
5391+
hash = Int32Add(Word32Xor(hash, Int32Constant(0xFFFFFFFF)),
54015392
Word32Shl(hash, Int32Constant(15)));
54025393
hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(12)));
54035394
hash = Int32Add(hash, Word32Shl(hash, Int32Constant(2)));
54045395
hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(4)));
54055396
hash = Int32Mul(hash, Int32Constant(2057));
54065397
hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(16)));
5407-
return Word32And(hash, Int32Constant(0x3fffffff));
5398+
return Word32And(hash, Int32Constant(0x3FFFFFFF));
5399+
}
5400+
5401+
Node* CodeStubAssembler::ComputeSeededHash(Node* key) {
5402+
Node* const function_addr =
5403+
ExternalConstant(ExternalReference::compute_integer_hash(isolate()));
5404+
Node* const isolate_ptr =
5405+
ExternalConstant(ExternalReference::isolate_address(isolate()));
5406+
5407+
MachineType type_ptr = MachineType::Pointer();
5408+
MachineType type_uint32 = MachineType::Uint32();
5409+
5410+
Node* const result =
5411+
CallCFunction2(type_uint32, type_ptr, type_uint32, function_addr,
5412+
isolate_ptr, TruncateWordToWord32(key));
5413+
return result;
54085414
}
54095415

54105416
template <typename Dictionary>
@@ -5420,10 +5426,14 @@ void CodeStubAssembler::NumberDictionaryLookup(Node* dictionary,
54205426
Node* capacity = SmiUntag(GetCapacity<Dictionary>(dictionary));
54215427
Node* mask = IntPtrSub(capacity, IntPtrConstant(1));
54225428

5423-
Node* int32_seed = std::is_same<Dictionary, SeededNumberDictionary>::value
5424-
? HashSeed()
5425-
: Int32Constant(kZeroHashSeed);
5426-
Node* hash = ChangeUint32ToWord(ComputeIntegerHash(intptr_index, int32_seed));
5429+
Node* hash;
5430+
5431+
if (std::is_same<Dictionary, SeededNumberDictionary>::value) {
5432+
hash = ChangeUint32ToWord(ComputeSeededHash(intptr_index));
5433+
} else {
5434+
hash = ChangeUint32ToWord(ComputeUnseededHash(intptr_index));
5435+
}
5436+
54275437
Node* key_as_float64 = RoundIntPtrToFloat64(intptr_index);
54285438

54295439
// See Dictionary::FirstProbe().
Collapse file

‎deps/v8/src/code-stub-assembler.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/code-stub-assembler.h
+2-3Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
170170
HEAP_CONSTANT_LIST(HEAP_CONSTANT_TEST)
171171
#undef HEAP_CONSTANT_TEST
172172

173-
Node* HashSeed();
174173
Node* StaleRegisterConstant();
175174

176175
Node* IntPtrOrSmiConstant(int value, ParameterMode mode);
@@ -1276,8 +1275,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
12761275
int inlined_probes = kInlinedDictionaryProbes,
12771276
LookupMode mode = kFindExisting);
12781277

1279-
Node* ComputeIntegerHash(Node* key);
1280-
Node* ComputeIntegerHash(Node* key, Node* seed);
1278+
Node* ComputeUnseededHash(Node* key);
1279+
Node* ComputeSeededHash(Node* key);
12811280

12821281
template <typename Dictionary>
12831282
void NumberDictionaryLookup(Node* dictionary, Node* intptr_index,
Collapse file

‎deps/v8/src/external-reference-table.cc‎

Copy file name to clipboardExpand all lines: deps/v8/src/external-reference-table.cc
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,8 @@ void ExternalReferenceTable::AddReferences(Isolate* isolate) {
232232
"try_internalize_string_function");
233233
Add(ExternalReference::check_object_type(isolate).address(),
234234
"check_object_type");
235+
Add(ExternalReference::compute_integer_hash(isolate).address(),
236+
"ComputeSeededHash");
235237
#ifdef V8_INTL_SUPPORT
236238
Add(ExternalReference::intl_convert_one_byte_to_lower(isolate).address(),
237239
"intl_convert_one_byte_to_lower");
Collapse file

‎deps/v8/src/flag-definitions.h‎

Copy file name to clipboardExpand all lines: deps/v8/src/flag-definitions.h
+4-3Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,7 @@ struct MaybeBoolFlag {
160160
FLAG(MAYBE_BOOL, MaybeBoolFlag, nam, {false COMMA false}, cmt)
161161
#define DEFINE_INT(nam, def, cmt) FLAG(INT, int, nam, def, cmt)
162162
#define DEFINE_UINT(nam, def, cmt) FLAG(UINT, unsigned int, nam, def, cmt)
163+
#define DEFINE_UINT64(nam, def, cmt) FLAG(UINT64, uint64_t, nam, def, cmt)
163164
#define DEFINE_FLOAT(nam, def, cmt) FLAG(FLOAT, double, nam, def, cmt)
164165
#define DEFINE_STRING(nam, def, cmt) FLAG(STRING, const char*, nam, def, cmt)
165166
#define DEFINE_ARGS(nam, cmt) FLAG(ARGS, JSArguments, nam, {0 COMMA NULL}, cmt)
@@ -914,9 +915,9 @@ DEFINE_BOOL(randomize_hashes, true,
914915
"(with snapshots this option cannot override the baked-in seed)")
915916
DEFINE_BOOL(rehash_snapshot, true,
916917
"rehash strings from the snapshot to override the baked-in seed")
917-
DEFINE_INT(hash_seed, 0,
918-
"Fixed seed to use to hash property keys (0 means random)"
919-
"(with snapshots this option cannot override the baked-in seed)")
918+
DEFINE_UINT64(hash_seed, 0,
919+
"Fixed seed to use to hash property keys (0 means random)"
920+
"(with snapshots this option cannot override the baked-in seed)")
920921
DEFINE_INT(random_seed, 0,
921922
"Default seed for initializing random generator "
922923
"(0, the default, means to use system random).")

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.