Quoting the CVE:
Google V8, as used in Google Chrome before 28.0.1500.95, allows
remote attackers to cause a denial of service or possibly have
unspecified other impact via vectors that leverage "type confusion."
Likely has zero impact on node.js because it only runs local, trusted
code but let's apply it anyway.
This is a back-port of upstream commit r15665. Original commit log:
Use internal array as API function cache.
R=yangguo@chromium.org
BUG=chromium:260106
TEST=cctest/test-api/Regress260106
Review URL: https://codereview.chromium.org/19159003Fixes#5973.
- If V8 snapshots are enabled then the hash is only randomized at build time.
---
backport @10366, @10367 and @10402 to 3.6
Add seed to hash of numeric keyed properties.
Minor cleanups of numeric seeded hashing patch.
Split NumberDictionary into a randomly seeded and an unseeded version.
We don't want to randomize the stub cache.
Review URL: http://codereview.chromium.org/9190001/
- If V8 snapshots are enabled then the hash is only randomized at build time.
- Breaks MIPS
---
Backport hash collision workaround to 3.6.
This is made up of 9956, 10351, 10338 and 10330.
This change bakes the string hash key into the snapshot, so
it is determined at build time for shapshot configs.
Review URL: http://codereview.chromium.org/9124004
This reverts commit 92f5a5d3ca.
V8 3.7.1 in debug mode on ia32 has a curious race-like bug where an fs.Stats
object is not fully formed until some time after it's created. This is easy
to demonstrate by running `make test-debug`.
V8 3.7.0 does not exhibit this behaviour so back we go.
Fixes#1981.