Skip to content

Commit 076acd0

Browse files
devsnekjoyeecheung
authored and
aduh95
committed
deps: V8: backport 0a8b1cdcc8b2
Original commit message: implement rapidhash secret generation Bug: 409717082 Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490 Reviewed-by: Leszek Swirski <[email protected]> Commit-Queue: snek <[email protected]> Cr-Commit-Position: refs/heads/main@{#101499} Refs: v8/v8@0a8b1cd Co-authored-by: Joyee Cheung <[email protected]> Backport-PR-URL: nodejs-private/node-private#833 Reviewed-By: Antoine du Hamel <[email protected]> PR-URL: nodejs-private/node-private#809 CVE-ID: CVE-2026-21717
1 parent 06fc343 commit 076acd0

36 files changed

+692
-78
lines changed

‎common.gypi‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@
3838

3939
# Reset this number to 0 on major V8 upgrades.
4040
# Increment by one for each non-official patch applied to deps/v8.
41-
'v8_embedder_string': '-node.35',
41+
'v8_embedder_string': '-node.36',
4242

4343
##### V8 defaults for Node.js #####
4444

‎deps/v8/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@
8080
!/third_party/inspector_protocol
8181
!/third_party/jsoncpp
8282
/third_party/jsoncpp/source
83+
!/third_party/rapidhash-v8
8384
!/third_party/re2
8485
/third_party/re2/src
8586
!/third_party/test262-harness

‎deps/v8/BUILD.bazel‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1849,6 +1849,7 @@ filegroup(
18491849
"src/numbers/conversions.cc",
18501850
"src/numbers/conversions.h",
18511851
"src/numbers/conversions-inl.h",
1852+
"src/numbers/hash-seed.h",
18521853
"src/numbers/hash-seed-inl.h",
18531854
"src/numbers/integer-literal.h",
18541855
"src/numbers/integer-literal-inl.h",
@@ -2444,6 +2445,8 @@ filegroup(
24442445
"src/zone/zone-segment.h",
24452446
"src/zone/zone-type-traits.h",
24462447
"src/zone/zone-utils.h",
2448+
"third_party/rapidhash-v8/rapidhash.h",
2449+
"third_party/rapidhash-v8/secret.h",
24472450
":cppgc_base_files",
24482451
":generated_bytecode_builtins_list",
24492452
":v8_bigint",

‎deps/v8/BUILD.gn‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -428,6 +428,9 @@ declare_args() {
428428
# Whether custom embedder snapshots may extend (= allocate new objects in)
429429
# ReadOnlySpace.
430430
v8_enable_extensible_ro_snapshot = true
431+
432+
# Use a hard-coded secret value when hashing.
433+
v8_use_default_hasher_secret = true
431434
}
432435

433436
# Derived defaults.
@@ -863,6 +866,7 @@ config("external_startup_data") {
863866
# Make sure the |v8_generate_features_json| action is also updated when adding
864867
# or removing defines below.
865868
external_v8_defines = [
869+
"V8_USE_DEFAULT_HASHER_SECRET=${v8_use_default_hasher_secret}",
866870
"V8_ENABLE_CHECKS",
867871
"V8_COMPRESS_POINTERS",
868872
"V8_COMPRESS_POINTERS_IN_SHARED_CAGE",
@@ -880,7 +884,9 @@ external_v8_defines = [
880884
"V8_MINORMS_STRING_SHORTCUTTING",
881885
]
882886

883-
enabled_external_v8_defines = []
887+
enabled_external_v8_defines = [
888+
"V8_USE_DEFAULT_HASHER_SECRET=${v8_use_default_hasher_secret}",
889+
]
884890

885891
if (v8_enable_v8_checks) {
886892
enabled_external_v8_defines += [ "V8_ENABLE_CHECKS" ]
@@ -2768,6 +2774,7 @@ generated_file("v8_generate_features_json") {
27682774
v8_random_seed = v8_random_seed
27692775
v8_use_perfetto = v8_use_perfetto
27702776
v8_use_siphash = v8_use_siphash
2777+
v8_use_default_hasher_secret = v8_use_default_hasher_secret
27712778
}
27722779
}
27732780

@@ -3763,6 +3770,7 @@ v8_header_set("v8_internal_headers") {
37633770
"src/numbers/conversions-inl.h",
37643771
"src/numbers/conversions.h",
37653772
"src/numbers/hash-seed-inl.h",
3773+
"src/numbers/hash-seed.h",
37663774
"src/numbers/math-random.h",
37673775
"src/objects/all-objects-inl.h",
37683776
"src/objects/allocation-site-inl.h",
@@ -4116,6 +4124,8 @@ v8_header_set("v8_internal_headers") {
41164124
"src/temporal/temporal-parser.h",
41174125
"src/third_party/siphash/halfsiphash.h",
41184126
"src/third_party/utf8-decoder/utf8-decoder.h",
4127+
"third_party/rapidhash-v8/rapidhash.h",
4128+
"third_party/rapidhash-v8/secret.h",
41194129
"src/torque/runtime-macro-shims.h",
41204130
"src/tracing/trace-event.h",
41214131
"src/tracing/traced-value.h",

‎deps/v8/src/DEPS‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,4 +123,13 @@ specific_include_rules = {
123123
"snapshot\.cc": [
124124
"+src/heap/read-only-promotion.h",
125125
],
126+
"string-hasher-inl\.h": [
127+
"+third_party/rapidhash-v8/rapidhash.h",
128+
],
129+
"heap\.cc": [
130+
"+third_party/rapidhash-v8/secret.h",
131+
],
132+
"hash-seed-inl\.h": [
133+
"+third_party/rapidhash-v8/secret.h",
134+
],
126135
}

‎deps/v8/src/ast/ast-value-factory.cc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,8 @@ std::forward_list<const AstRawString*> AstConsString::ToRawStrings() const {
291291
return result;
292292
}
293293

294-
AstStringConstants::AstStringConstants(Isolate* isolate, uint64_t hash_seed)
294+
AstStringConstants::AstStringConstants(Isolate* isolate,
295+
const HashSeed hash_seed)
295296
: zone_(isolate->allocator(), ZONE_NAME),
296297
string_table_(),
297298
hash_seed_(hash_seed) {

‎deps/v8/src/ast/ast-value-factory.h‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
#include "src/common/globals.h"
3636
#include "src/handles/handles.h"
3737
#include "src/numbers/conversions.h"
38+
#include "src/numbers/hash-seed.h"
3839
#include "src/objects/name.h"
3940

4041
// Ast(Raw|Cons)String and AstValueFactory are for storing strings and
@@ -290,7 +291,7 @@ using AstRawStringMap =
290291

291292
class AstStringConstants final {
292293
public:
293-
AstStringConstants(Isolate* isolate, uint64_t hash_seed);
294+
AstStringConstants(Isolate* isolate, const HashSeed hash_seed);
294295
AstStringConstants(const AstStringConstants&) = delete;
295296
AstStringConstants& operator=(const AstStringConstants&) = delete;
296297

@@ -299,13 +300,13 @@ class AstStringConstants final {
299300
AST_STRING_CONSTANTS(F)
300301
#undef F
301302

302-
uint64_t hash_seed() const { return hash_seed_; }
303+
const HashSeed hash_seed() const { return hash_seed_; }
303304
const AstRawStringMap* string_table() const { return &string_table_; }
304305

305306
private:
306307
Zone zone_;
307308
AstRawStringMap string_table_;
308-
uint64_t hash_seed_;
309+
const HashSeed hash_seed_;
309310

310311
#define F(name, str) AstRawString* name##_string_;
311312
AST_STRING_CONSTANTS(F)
@@ -315,12 +316,12 @@ class AstStringConstants final {
315316
class AstValueFactory {
316317
public:
317318
AstValueFactory(Zone* zone, const AstStringConstants* string_constants,
318-
uint64_t hash_seed)
319+
const HashSeed hash_seed)
319320
: AstValueFactory(zone, zone, string_constants, hash_seed) {}
320321

321322
AstValueFactory(Zone* ast_raw_string_zone, Zone* single_parse_zone,
322323
const AstStringConstants* string_constants,
323-
uint64_t hash_seed)
324+
const HashSeed hash_seed)
324325
: string_table_(string_constants->string_table()),
325326
strings_(nullptr),
326327
strings_end_(&strings_),
@@ -418,7 +419,7 @@ class AstValueFactory {
418419
Zone* ast_raw_string_zone_;
419420
Zone* single_parse_zone_;
420421

421-
uint64_t hash_seed_;
422+
const HashSeed hash_seed_;
422423
};
423424

424425
extern template EXPORT_TEMPLATE_DECLARE(

‎deps/v8/src/codegen/external-reference.cc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1176,7 +1176,8 @@ FUNCTION_REFERENCE(jsreceiver_create_identity_hash,
11761176

11771177
static uint32_t ComputeSeededIntegerHash(Isolate* isolate, int32_t key) {
11781178
DisallowGarbageCollection no_gc;
1179-
return ComputeSeededHash(static_cast<uint32_t>(key), HashSeed(isolate));
1179+
return ComputeSeededHash(static_cast<uint32_t>(key),
1180+
HashSeed(isolate).seed());
11801181
}
11811182

11821183
FUNCTION_REFERENCE(compute_integer_hash, ComputeSeededIntegerHash)

‎deps/v8/src/debug/debug-interface.cc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -910,7 +910,8 @@ uint32_t WasmScript::GetFunctionHash(int function_index) {
910910
wire_bytes.GetFunctionBytes(&func);
911911
// TODO(herhut): Maybe also take module, name and signature into account.
912912
return i::StringHasher::HashSequentialString(function_bytes.begin(),
913-
function_bytes.length(), 0);
913+
function_bytes.length(),
914+
internal::HashSeed::Default());
914915
}
915916

916917
int WasmScript::CodeOffset() const {

‎deps/v8/src/heap/heap.cc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@
119119
#include "src/tracing/trace-event.h"
120120
#include "src/utils/utils-inl.h"
121121
#include "src/utils/utils.h"
122+
#include "third_party/rapidhash-v8/secret.h"
122123

123124
#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
124125
#include "src/heap/conservative-stack-visitor.h"
@@ -5825,9 +5826,20 @@ void Heap::InitializeHashSeed() {
58255826
} else {
58265827
new_hash_seed = static_cast<uint64_t>(v8_flags.hash_seed);
58275828
}
5829+
58285830
Tagged<ByteArray> hash_seed = ReadOnlyRoots(this).hash_seed();
5831+
58295832
MemCopy(hash_seed->begin(), reinterpret_cast<uint8_t*>(&new_hash_seed),
58305833
kInt64Size);
5834+
5835+
#if V8_USE_DEFAULT_HASHER_SECRET
5836+
MemCopy(hash_seed->begin() + kInt64Size,
5837+
reinterpret_cast<const uint8_t*>(RAPIDHASH_DEFAULT_SECRET),
5838+
kInt64Size * 3);
5839+
#else
5840+
rapidhash_make_secret(new_hash_seed, reinterpret_cast<uint64_t*>(
5841+
hash_seed->begin() + kInt64Size));
5842+
#endif // V8_USE_DEFAULT_HASHER_SECRET
58315843
}
58325844

58335845
std::shared_ptr<v8::TaskRunner> Heap::GetForegroundTaskRunner() const {

0 commit comments

Comments
 (0)