Skip to content

Commit f08373f

Browse files
hashseedtargos
hashseed
authored and
targos
committed
deps: cherry-pick 64-bit hash seed commits from V8
This serves as mitigation for the so-called HashWick vulnerability. Original commit messages: commit d5686a74d56fbb6985b22663ddadd66eb7b91519 Author: Yang Guo <[email protected]> Date: Mon Jul 16 11:19:42 2018 Extend hash seed to 64 bits [email protected], [email protected] Bug: chromium:680662 Change-Id: I5e1486ad2a42db2998d5485a0c4e711378678e6c Reviewed-on: https://chromium-review.googlesource.com/1136034 Reviewed-by: Marja Hölttä <[email protected]> Reviewed-by: Ulan Degenbaev <[email protected]> Reviewed-by: Benedikt Meurer <[email protected]> Commit-Queue: Yang Guo <[email protected]> Cr-Commit-Position: refs/heads/master@{#54460} commit 3833fef57368c53c6170559ffa524c8c69f16ee5 Author: Yang Guo <[email protected]> Date: Thu Sep 20 11:43:13 2018 Refactor integer hashing function names We now clearly differentiate between: - unseeded hash for 32-bit integers - unseeded hash for 64-bit integers - seeded hash for 32-bit integers - seeded hash for strings [email protected] Bug: chromium:680662 Change-Id: I7459958c4158ee3501c962943dff8f33258bb5ce Reviewed-on: https://chromium-review.googlesource.com/1235973 Commit-Queue: Yang Guo <[email protected]> Reviewed-by: Benedikt Meurer <[email protected]> Cr-Commit-Position: refs/heads/master@{#56068} commit 95a979e02d7154e45b293261a6998c99d71fc238 Author: Yang Guo <[email protected]> Date: Thu Sep 20 14:34:48 2018 Call into C++ to compute seeded integer hash [email protected] Bug: chromium:680662 Change-Id: I8dace89d576dfcc5833fd539ce698a9ade1cb5a0 Reviewed-on: https://chromium-review.googlesource.com/1235928 Commit-Queue: Yang Guo <[email protected]> Reviewed-by: Benedikt Meurer <[email protected]> Cr-Commit-Position: refs/heads/master@{#56091} commit 2c2af0022d5feb9e525a00a76cb15db9f3e38dba Author: Yang Guo <[email protected]> Date: Thu Sep 27 16:37:57 2018 Use 64-bit for seeded integer hashes [email protected] Bug: chromium:680662 Change-Id: If48d1043dbe1e1bb695ec890c23e103a6cacf2d4 Reviewed-on: https://chromium-review.googlesource.com/1244220 Commit-Queue: Yang Guo <[email protected]> Reviewed-by: Peter Marshall <[email protected]> Cr-Commit-Position: refs/heads/master@{#56271} Refs: #23259 PR-URL: #23260 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Ali Ijaz Sheikh <[email protected]>
1 parent 77de1be commit f08373f

40 files changed

+172
-140
lines changed

‎common.gypi

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@
2525
'uv_library%': 'static_library',
2626

2727
'clang%': 0,
28-
28+
2929
'openssl_fips%': '',
3030

3131
# Default to -O0 for debug builds.
3232
'v8_optimized_debug%': 0,
3333

3434
# Reset this number to 0 on major V8 upgrades.
3535
# Increment by one for each non-official patch applied to deps/v8.
36-
'v8_embedder_string': '-node.32',
36+
'v8_embedder_string': '-node.33',
3737

3838
# Enable disassembler for `--print-code` v8 options
3939
'v8_enable_disassembler': 1,

‎deps/v8/src/ast/ast-value-factory.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,7 @@ std::forward_list<const AstRawString*> AstConsString::ToRawStrings() const {
182182
return result;
183183
}
184184

185-
AstStringConstants::AstStringConstants(Isolate* isolate, uint32_t hash_seed)
185+
AstStringConstants::AstStringConstants(Isolate* isolate, uint64_t hash_seed)
186186
: zone_(isolate->allocator(), ZONE_NAME),
187187
string_table_(AstRawString::Compare),
188188
hash_seed_(hash_seed) {

‎deps/v8/src/ast/ast-value-factory.h

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -240,22 +240,22 @@ class AstBigInt {
240240

241241
class AstStringConstants final {
242242
public:
243-
AstStringConstants(Isolate* isolate, uint32_t hash_seed);
243+
AstStringConstants(Isolate* isolate, uint64_t hash_seed);
244244

245245
#define F(name, str) \
246246
const AstRawString* name##_string() const { return name##_string_; }
247247
AST_STRING_CONSTANTS(F)
248248
#undef F
249249

250-
uint32_t hash_seed() const { return hash_seed_; }
250+
uint64_t hash_seed() const { return hash_seed_; }
251251
const base::CustomMatcherHashMap* string_table() const {
252252
return &string_table_;
253253
}
254254

255255
private:
256256
Zone zone_;
257257
base::CustomMatcherHashMap string_table_;
258-
uint32_t hash_seed_;
258+
uint64_t hash_seed_;
259259

260260
#define F(name, str) AstRawString* name##_string_;
261261
AST_STRING_CONSTANTS(F)
@@ -267,7 +267,7 @@ class AstStringConstants final {
267267
class AstValueFactory {
268268
public:
269269
AstValueFactory(Zone* zone, const AstStringConstants* string_constants,
270-
uint32_t hash_seed)
270+
uint64_t hash_seed)
271271
: string_table_(string_constants->string_table()),
272272
strings_(nullptr),
273273
strings_end_(&strings_),
@@ -354,7 +354,7 @@ class AstValueFactory {
354354

355355
Zone* zone_;
356356

357-
uint32_t hash_seed_;
357+
uint64_t hash_seed_;
358358
};
359359
} // namespace internal
360360
} // namespace v8

‎deps/v8/src/builtins/builtins-collections-gen.cc

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -684,7 +684,7 @@ class CollectionsBuiltinsAssembler : public BaseCollectionsAssembler {
684684
Node* key_tagged, Variable* result,
685685
Label* entry_found,
686686
Label* not_found);
687-
Node* ComputeIntegerHashForString(Node* context, Node* string_key);
687+
Node* ComputeStringHash(Node* context, Node* string_key);
688688
void SameValueZeroString(Node* context, Node* key_string, Node* candidate_key,
689689
Label* if_same, Label* if_not_same);
690690

@@ -828,8 +828,7 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForSmiKey(
828828
Node* table, Node* smi_key, Variable* result, Label* entry_found,
829829
Label* not_found) {
830830
Node* const key_untagged = SmiUntag(smi_key);
831-
Node* const hash =
832-
ChangeInt32ToIntPtr(ComputeIntegerHash(key_untagged, Int32Constant(0)));
831+
Node* const hash = ChangeInt32ToIntPtr(ComputeUnseededHash(key_untagged));
833832
CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
834833
result->Bind(hash);
835834
FindOrderedHashTableEntry<CollectionType>(
@@ -844,7 +843,7 @@ template <typename CollectionType>
844843
void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForStringKey(
845844
Node* context, Node* table, Node* key_tagged, Variable* result,
846845
Label* entry_found, Label* not_found) {
847-
Node* const hash = ComputeIntegerHashForString(context, key_tagged);
846+
Node* const hash = ComputeStringHash(context, key_tagged);
848847
CSA_ASSERT(this, IntPtrGreaterThanOrEqual(hash, IntPtrConstant(0)));
849848
result->Bind(hash);
850849
FindOrderedHashTableEntry<CollectionType>(
@@ -902,8 +901,8 @@ void CollectionsBuiltinsAssembler::FindOrderedHashTableEntryForOtherKey(
902901
result, entry_found, not_found);
903902
}
904903

905-
Node* CollectionsBuiltinsAssembler::ComputeIntegerHashForString(
906-
Node* context, Node* string_key) {
904+
Node* CollectionsBuiltinsAssembler::ComputeStringHash(Node* context,
905+
Node* string_key) {
907906
VARIABLE(var_result, MachineType::PointerRepresentation());
908907

909908
Label hash_not_computed(this), done(this, &var_result);

‎deps/v8/src/code-stub-assembler.cc

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -230,10 +230,6 @@ HEAP_CONSTANT_LIST(HEAP_CONSTANT_ACCESSOR);
230230
HEAP_CONSTANT_LIST(HEAP_CONSTANT_TEST);
231231
#undef HEAP_CONSTANT_TEST
232232

233-
TNode<Int32T> CodeStubAssembler::HashSeed() {
234-
return LoadAndUntagToWord32Root(Heap::kHashSeedRootIndex);
235-
}
236-
237233
Node* CodeStubAssembler::IntPtrOrSmiConstant(int value, ParameterMode mode) {
238234
if (mode == SMI_PARAMETERS) {
239235
return SmiConstant(value);
@@ -7094,14 +7090,9 @@ template void CodeStubAssembler::NameDictionaryLookup<GlobalDictionary>(
70947090
TNode<GlobalDictionary>, TNode<Name>, Label*, TVariable<IntPtrT>*, Label*,
70957091
int, LookupMode);
70967092

7097-
Node* CodeStubAssembler::ComputeIntegerHash(Node* key) {
7098-
return ComputeIntegerHash(key, IntPtrConstant(kZeroHashSeed));
7099-
}
7100-
7101-
Node* CodeStubAssembler::ComputeIntegerHash(Node* key, Node* seed) {
7102-
// See v8::internal::ComputeIntegerHash()
7093+
Node* CodeStubAssembler::ComputeUnseededHash(Node* key) {
7094+
// See v8::internal::ComputeUnseededHash()
71037095
Node* hash = TruncateIntPtrToInt32(key);
7104-
hash = Word32Xor(hash, seed);
71057096
hash = Int32Add(Word32Xor(hash, Int32Constant(0xFFFFFFFF)),
71067097
Word32Shl(hash, Int32Constant(15)));
71077098
hash = Word32Xor(hash, Word32Shr(hash, Int32Constant(12)));
@@ -7112,6 +7103,21 @@ Node* CodeStubAssembler::ComputeIntegerHash(Node* key, Node* seed) {
71127103
return Word32And(hash, Int32Constant(0x3FFFFFFF));
71137104
}
71147105

7106+
Node* CodeStubAssembler::ComputeSeededHash(Node* key) {
7107+
Node* const function_addr =
7108+
ExternalConstant(ExternalReference::compute_integer_hash());
7109+
Node* const isolate_ptr =
7110+
ExternalConstant(ExternalReference::isolate_address(isolate()));
7111+
7112+
MachineType type_ptr = MachineType::Pointer();
7113+
MachineType type_uint32 = MachineType::Uint32();
7114+
7115+
Node* const result =
7116+
CallCFunction2(type_uint32, type_ptr, type_uint32, function_addr,
7117+
isolate_ptr, TruncateIntPtrToInt32(key));
7118+
return result;
7119+
}
7120+
71157121
void CodeStubAssembler::NumberDictionaryLookup(
71167122
TNode<NumberDictionary> dictionary, TNode<IntPtrT> intptr_index,
71177123
Label* if_found, TVariable<IntPtrT>* var_entry, Label* if_not_found) {
@@ -7122,9 +7128,7 @@ void CodeStubAssembler::NumberDictionaryLookup(
71227128
TNode<IntPtrT> capacity = SmiUntag(GetCapacity<NumberDictionary>(dictionary));
71237129
TNode<WordT> mask = IntPtrSub(capacity, IntPtrConstant(1));
71247130

7125-
TNode<Int32T> int32_seed = HashSeed();
7126-
TNode<WordT> hash =
7127-
ChangeUint32ToWord(ComputeIntegerHash(intptr_index, int32_seed));
7131+
TNode<WordT> hash = ChangeUint32ToWord(ComputeSeededHash(intptr_index));
71287132
Node* key_as_float64 = RoundIntPtrToFloat64(intptr_index);
71297133

71307134
// See Dictionary::FirstProbe().

‎deps/v8/src/code-stub-assembler.h

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -221,8 +221,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
221221
HEAP_CONSTANT_LIST(HEAP_CONSTANT_TEST)
222222
#undef HEAP_CONSTANT_TEST
223223

224-
TNode<Int32T> HashSeed();
225-
226224
Node* IntPtrOrSmiConstant(int value, ParameterMode mode);
227225
TNode<BoolT> BoolConstant(bool value) {
228226
return value ? Int32TrueConstant() : Int32FalseConstant();
@@ -1883,8 +1881,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
18831881
int inlined_probes = kInlinedDictionaryProbes,
18841882
LookupMode mode = kFindExisting);
18851883

1886-
Node* ComputeIntegerHash(Node* key);
1887-
Node* ComputeIntegerHash(Node* key, Node* seed);
1884+
Node* ComputeUnseededHash(Node* key);
1885+
Node* ComputeSeededHash(Node* key);
18881886

18891887
void NumberDictionaryLookup(TNode<NumberDictionary> dictionary,
18901888
TNode<IntPtrT> intptr_index, Label* if_found,

‎deps/v8/src/compiler/effect-control-linearizer.cc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4583,8 +4583,8 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntry(Node* node) {
45834583
}
45844584
}
45854585

4586-
Node* EffectControlLinearizer::ComputeIntegerHash(Node* value) {
4587-
// See v8::internal::ComputeIntegerHash()
4586+
Node* EffectControlLinearizer::ComputeUnseededHash(Node* value) {
4587+
// See v8::internal::ComputeUnseededHash()
45884588
value = __ Int32Add(__ Word32Xor(value, __ Int32Constant(0xFFFFFFFF)),
45894589
__ Word32Shl(value, __ Int32Constant(15)));
45904590
value = __ Word32Xor(value, __ Word32Shr(value, __ Int32Constant(12)));
@@ -4602,7 +4602,7 @@ Node* EffectControlLinearizer::LowerFindOrderedHashMapEntryForInt32Key(
46024602
Node* key = NodeProperties::GetValueInput(node, 1);
46034603

46044604
// Compute the integer hash code.
4605-
Node* hash = ChangeUint32ToUintPtr(ComputeIntegerHash(key));
4605+
Node* hash = ChangeUint32ToUintPtr(ComputeUnseededHash(key));
46064606

46074607
Node* number_of_buckets = ChangeSmiToIntPtr(__ LoadField(
46084608
AccessBuilder::ForOrderedHashTableBaseNumberOfBuckets(), table));

‎deps/v8/src/compiler/effect-control-linearizer.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ class V8_EXPORT_PRIVATE EffectControlLinearizer {
178178
Node* frame_state);
179179
Node* BuildFloat64RoundDown(Node* value);
180180
Node* BuildFloat64RoundTruncate(Node* input);
181-
Node* ComputeIntegerHash(Node* value);
181+
Node* ComputeUnseededHash(Node* value);
182182
Node* LowerStringComparison(Callable const& callable, Node* node);
183183
Node* IsElementsKindGreaterThan(Node* kind, ElementsKind reference_kind);
184184

‎deps/v8/src/external-reference.cc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -778,6 +778,15 @@ ExternalReference ExternalReference::jsreceiver_create_identity_hash(
778778
return ExternalReference(Redirect(FUNCTION_ADDR(f)));
779779
}
780780

781+
static uint32_t ComputeSeededIntegerHash(Isolate* isolate, uint32_t key) {
782+
DisallowHeapAllocation no_gc;
783+
return ComputeSeededHash(key, isolate->heap()->HashSeed());
784+
}
785+
786+
ExternalReference ExternalReference::compute_integer_hash() {
787+
return ExternalReference(Redirect(FUNCTION_ADDR(ComputeSeededIntegerHash)));
788+
}
789+
781790
ExternalReference
782791
ExternalReference::copy_fast_number_jsarray_elements_to_typed_array() {
783792
return ExternalReference(

‎deps/v8/src/external-reference.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ class StatsCounter;
8181
V(address_of_uint32_bias, "uint32_bias") \
8282
V(bytecode_size_table_address, "Bytecodes::bytecode_size_table_address") \
8383
V(check_object_type, "check_object_type") \
84+
V(compute_integer_hash, "ComputeSeededHash") \
8485
V(compute_output_frames_function, "Deoptimizer::ComputeOutputFrames()") \
8586
V(copy_fast_number_jsarray_elements_to_typed_array, \
8687
"copy_fast_number_jsarray_elements_to_typed_array") \

0 commit comments

Comments
 (0)