Commit 9382b3b
deps: V8: cherry-pick e0a109c
Original commit message:
[api] Implement StartupData::CanBeRehashed() for the snapshot blob
This enables the embedder to check if the snapshot generated
from SnapshotCreator::CreateBlob() can be rehashed and the seed
can be recomputed during deserialization.
The lack of this functionality resulted in a temporary vunerability
in Node.js: #27365
Change-Id: I88d52337217c40f79c26438be3c87d2db874d980
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1578661
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61175}
Refs: v8/v8@e0a109c
PR-URL: #27533
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Refael Ackermann (רפאל פלחי) <refack@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>1 parent 6014429 commit 9382b3b
6 files changed
Lines changed: 20 additions & 3 deletions
File tree
- deps/v8
- include
- src
- snapshot
- test/cctest
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -38,7 +38,7 @@ | |||
| 38 | 38 | ||
| 39 | 39 | # Reset this number to 0 on major V8 upgrades. | |
| 40 | 40 | # Increment by one for each non-official patch applied to deps/v8. | |
| 41 | - 'v8_embedder_string': '-node.13', | ||
| 41 | + 'v8_embedder_string': '-node.14', | ||
| 42 | 42 | ||
| 43 | 43 | ##### V8 defaults for Node.js ##### | |
| 44 | 44 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -8605,6 +8605,13 @@ class V8_EXPORT Isolate { | |||
| 8605 | 8605 | ||
| 8606 | 8606 | class V8_EXPORT StartupData { | |
| 8607 | 8607 | public: | |
| 8608 | + /** | ||
| 8609 | + * Whether the data created can be rehashed and and the hash seed can be | ||
| 8610 | + * recomputed when deserialized. | ||
| 8611 | + * Only valid for StartupData returned by SnapshotCreator::CreateBlob(). | ||
| 8612 | + */ | ||
| 8613 | + bool CanBeRehashed() const; | ||
| 8614 | + | ||
| 8608 | 8615 | const char* data; | |
| 8609 | 8616 | int raw_size; | |
| 8610 | 8617 | }; | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -887,6 +887,11 @@ StartupData SnapshotCreator::CreateBlob( | |||
| 887 | 887 | return result; | |
| 888 | 888 | } | |
| 889 | 889 | ||
| 890 | + bool StartupData::CanBeRehashed() const { | ||
| 891 | + DCHECK(i::Snapshot::VerifyChecksum(this)); | ||
| 892 | + return i::Snapshot::ExtractRehashability(this); | ||
| 893 | + } | ||
| 894 | + | ||
| 890 | 895 | void V8::SetDcheckErrorHandler(DcheckErrorCallback that) { | |
| 891 | 896 | v8::base::SetDcheckFunction(that); | |
| 892 | 897 | } | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -229,7 +229,9 @@ uint32_t Snapshot::ExtractContextOffset(const v8::StartupData* data, | |||
| 229 | 229 | ||
| 230 | 230 | bool Snapshot::ExtractRehashability(const v8::StartupData* data) { | |
| 231 | 231 | CHECK_LT(kRehashabilityOffset, static_cast<uint32_t>(data->raw_size)); | |
| 232 | - return GetHeaderValue(data, kRehashabilityOffset) != 0; | ||
| 232 | + uint32_t rehashability = GetHeaderValue(data, kRehashabilityOffset); | ||
| 233 | + CHECK_IMPLIES(rehashability != 0, rehashability == 1); | ||
| 234 | + return rehashability != 0; | ||
| 233 | 235 | } | |
| 234 | 236 | ||
| 235 | 237 | namespace { | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -87,11 +87,12 @@ class Snapshot : public AllStatic { | |||
| 87 | 87 | static bool SnapshotIsValid(const v8::StartupData* snapshot_blob); | |
| 88 | 88 | #endif // DEBUG | |
| 89 | 89 | ||
| 90 | + static bool ExtractRehashability(const v8::StartupData* data); | ||
| 91 | + | ||
| 90 | 92 | private: | |
| 91 | 93 | static uint32_t ExtractNumContexts(const v8::StartupData* data); | |
| 92 | 94 | static uint32_t ExtractContextOffset(const v8::StartupData* data, | |
| 93 | 95 | uint32_t index); | |
| 94 | - static bool ExtractRehashability(const v8::StartupData* data); | ||
| 95 | 96 | static Vector<const byte> ExtractStartupData(const v8::StartupData* data); | |
| 96 | 97 | static Vector<const byte> ExtractReadOnlyData(const v8::StartupData* data); | |
| 97 | 98 | static Vector<const byte> ExtractContextData(const v8::StartupData* data, | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3709,6 +3709,7 @@ UNINITIALIZED_TEST(ReinitializeHashSeedNotRehashable) { | |||
| 3709 | 3709 | } | |
| 3710 | 3710 | blob = | |
| 3711 | 3711 | creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear); | |
| 3712 | + CHECK(!blob.CanBeRehashed()); | ||
| 3712 | 3713 | } | |
| 3713 | 3714 | ||
| 3714 | 3715 | i::FLAG_hash_seed = 1337; | |
@@ -3774,6 +3775,7 @@ UNINITIALIZED_TEST(ReinitializeHashSeedRehashable) { | |||
| 3774 | 3775 | } | |
| 3775 | 3776 | blob = | |
| 3776 | 3777 | creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear); | |
| 3778 | + CHECK(blob.CanBeRehashed()); | ||
| 3777 | 3779 | } | |
| 3778 | 3780 | ||
| 3779 | 3781 | i::FLAG_hash_seed = 1337; | |
0 commit comments