russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
59 lines
3 KiB
ReStructuredText
59 lines
3 KiB
ReStructuredText
V8 JavaScript Engine — CWE-407 Analysis
|
||
========================================
|
||
|
||
.. contents:: :local:
|
||
|
||
Overview
|
||
--------
|
||
|
||
V8 is Google's JavaScript and WebAssembly engine, used in Chrome, Node.js, and Deno.
|
||
Its TurboFan and Turboshaft JIT compilers perform SSA construction, CFG analysis,
|
||
dominator tree computation, register allocation, and SCC-based loop analysis.
|
||
|
||
Status: **CLEAN** (scanned 2026-03-23)
|
||
---------------------------------------
|
||
|
||
Scan returned 21 candidates from ``src/compiler``, ``src/codegen``, and ``src/interpreter``.
|
||
All triaged as false positives.
|
||
|
||
Triage Summary
|
||
--------------
|
||
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
| Candidate | Container type | Verdict |
|
||
+==============================================+===================================+==========+
|
||
| ``all-nodes.h`` ``is_reachable_.Contains`` | ``BitVector`` — bit test | CLEAN |
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
| ``store-store`` ``active_keys_.Contains`` | ``IntrusiveSet`` — pointer O(1) | CLEAN |
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
| ``loop-finder.cc`` ``config_.contains`` | bitfield enum flags | CLEAN |
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
| ``macro-assembler`` ``Contains(tag_range)`` | range check (lo ≤ x ≤ hi) | CLEAN |
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
| ``turbofan-graph.cc`` ``decorators_`` find | ``ZoneVector`` ~0–2 items | FP |
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
| ``string-builder-optimizer`` find pred | ``SmallVector<BB*,15>`` capped | FP |
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
| ``wasm-shuffle-reducer`` std::find | static constexpr array ~8 items | FP |
|
||
+----------------------------------------------+-----------------------------------+----------+
|
||
|
||
V8's reachability analysis (``AllNodes``) uses ``BitVector`` for O(1) per-node visited
|
||
tracking — one bit per node ID, indexed directly. The Turboshaft store-store elimination
|
||
pass uses ``IntrusiveSet`` with an embedded index field in each key object. Both are
|
||
idiomatic O(1) membership structures.
|
||
|
||
The ``std::find`` calls on ``ZoneVector<GraphDecorator*>`` and ``SmallVector<BasicBlock*,15>``
|
||
are bounded: decorator vectors are 0–2 elements, the predecessor limit is a hardcoded
|
||
constant of 15. Not quadratic in any input.
|
||
|
||
Key Finding
|
||
-----------
|
||
|
||
V8's JIT compiler infrastructure was written after modern O(1) container idioms were
|
||
established in C++ (post-C++11). ``BitVector``, ``ZoneSet``, and ``IntrusiveSet`` are used
|
||
uniformly throughout compiler passes. No CWE-407 defect.
|
||
|
||
References
|
||
----------
|
||
|
||
* Scan result: ``tools/scan-results/v8.txt``
|