mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 18:25:13 +08:00
Joyee Cheung
af5c144ebc
This enables v8_enable_seeded_array_index_hash and add a test for it. Fixes: https://hackerone.com/reports/3511792 deps: V8: backport 0a8b1cdcc8b2 Original commit message: implement rapidhash secret generation Bug: 409717082 Change-Id: I471f33d66de32002f744aeba534c1d34f71e27d2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6733490 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: snek <snek@chromium.org> Cr-Commit-Position: refs/heads/main@{#101499} Refs: https://github.com/v8/v8/commit/0a8b1cdcc8b243c62cf045fa8beb50600e11758a Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 185f0fe09b72 Original commit message: [numbers] Refactor HashSeed as a lightweight view over ByteArray Instead of copying the seed and secrets into a struct with value fields, HashSeed now stores a pointer pointing either into the read-only ByteArray, or the static default seed for off-heap HashSeed::Default() calls. The underlying storage is always 8-byte aligned so we can cast it directly into a struct. Change-Id: I5896a7f2ae24296eb4c80b757a5d90ac70a34866 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7609720 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105531} Refs: https://github.com/v8/v8/commit/185f0fe09b72fb869fdcf9a89f40ff2295436bca Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: backport 1361b2a49d02 Original commit message: [strings] improve array index hash distribution Previously, the hashes stored in a Name's raw_hash_field for decimal numeric strings (potential array indices) consist of the literal integer value along with the length of the string. This means consecutive numeric strings can have consecutive hash values, which can lead to O(n^2) probing for insertion in the worst case when e.g. a non-numeric string happen to land in the these buckets. This patch adds a build-time flag v8_enable_seeded_array_index_hash that scrambles the 24-bit array-index value stored in a Name's raw_hash_field to improve the distribution. x ^= x >> kShift; x = (x * m1) & kMask; // round 1 x ^= x >> kShift; x = (x * m2) & kMask; // round 2 x ^= x >> kShift; // finalize To decode, apply the same steps with the modular inverses of m1 and m2 in reverse order. x ^= x >> kShift; x = (x * m2_inv) & kMask; // round 1 x ^= x >> kShift; x = (x * m1_inv) & kMask; // round 2 x ^= x >> kShift; // finalize where kShift = kArrayIndexValueBits / 2, kMask = kArrayIndexValueMask, m1, m2 (both odd) are the lower bits of the rapidhash secrets, m1_inv, m2_inv (modular inverses) are precomputed modular inverse of m1 and m2. The pre-computed values are appended to the hash_seed ByteArray in ReadOnlyRoots and accessed in generated code to reduce overhead. In call sites that don't already have access to the seeds, we read them from the current isolate group/isolate's read only roots. To consolidate the code that encode/decode these hashes, this patch adds MakeArrayIndexHash/DecodeArrayIndexFromHashField in C++ and CSA that perform seeding/unseeding if enabled, and updates places where encoding/decoding of array index is needed to use them. Bug: 477515021 Change-Id: I350afe511951a54c4378396538152cc56565fd55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7564330 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Joyee Cheung <joyee@igalia.com> Cr-Commit-Position: refs/heads/main@{#105596} Refs: https://github.com/v8/v8/commit/1361b2a49d020a718dc5495713eae0fa67d697b9 Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com> deps: V8: cherry-pick aac14dd95e5b Original commit message: [string] add 3rd round to seeded array index hash Since we already have 3 derived secrets, and arithmetics are relatively cheap, add a 3rd round to the xorshift-multiply seeding scheme. This brings the bias from ~3.4 to ~0.4. Bug: 477515021 Change-Id: I1ef48954bcee8768d8c90db06ac8adb02f06cebf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7655117 Reviewed-by: Chengzhong Wu <cwu631@bloomberg.net> Commit-Queue: Joyee Cheung <joyee@igalia.com> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#105824} Refs: https://github.com/v8/v8/commit/aac14dd95e5be0d487eba6bcdaf9cef4f8bd806c PR-URL: https://github.com/nodejs-private/node-private/pull/834 CVE-ID: CVE-2026-21717
Node.js Core Tests
This directory contains code and data used to test the Node.js implementation.
For a detailed guide on how to write tests in this directory, see the guide on writing tests.
On how to run tests in this directory, see the contributing guide.
For the tests to run on Windows, be sure to clone Node.js source code with the
autocrlf git config flag set to true.
Test Directories
| Directory | Runs on CI | Purpose |
|---|---|---|
abort |
Yes | Tests that use --abort-on-uncaught-exception and other cases where we want to avoid generating a core file. |
addons |
Yes | Tests for addon functionality along with some tests that require an addon. |
async-hooks |
Yes | Tests for async_hooks functionality. |
benchmark |
Yes | Test minimal functionality of benchmarks. |
cctest |
Yes | C++ tests that are run as part of the build process. |
code-cache |
No | Tests for a Node.js binary compiled with V8 code cache. |
common |
N/A | Common modules shared among many tests.1 |
doctool |
Yes | Tests for the documentation generator. |
es-module |
Yes | Test ESM module loading. |
fixtures |
N/A | Test fixtures used in various tests throughout the test suite. |
internet |
No | Tests that make real outbound network connections.2 |
js-native-api |
Yes | Tests for Node.js-agnostic Node-API functionality. |
known_issues |
Yes | Tests reproducing known issues within the system.3 |
message |
Yes | Tests for messages that are output for various conditions |
node-api |
Yes | Tests for Node.js-specific Node-API functionality. |
parallel |
Yes | Various tests that are able to be run in parallel. |
pseudo-tty |
Yes | Tests that require stdin/stdout/stderr to be a TTY. |
pummel |
No | Various tests for various modules / system functionality operating under load. |
sequential |
Yes | Various tests that must not run in parallel. |
testpy |
N/A | Test configuration utility used by various test suites. |
tick-processor |
No | Tests for the V8 tick processor integration.4 |
v8-updates |
No | Tests for V8 performance integration. |
-
Tests for networking related modules may also be present in other directories, but those tests do not make outbound connections. ↩︎
-
All tests inside of this directory are expected to fail. If a test doesn't fail on certain platforms, those should be skipped via
known_issues.status. ↩︎ -
The tests are for the logic in
lib/internal/v8_prof_processor.jsandlib/internal/v8_prof_polyfill.js. The tests confirm that the profile processor packages the correct set of scripts from V8 and introduces the correct platform specific logic. ↩︎