Possible collisions in the standard JavaScript Object hash table implementation?

Question

I recently happened to think about object property access times in JavaScript and came across this question which seemed to reasonably suggest that it should be constant time. This also made me wonder if there is a limit on object property key lengths. Apparently modern browsers support key lengths of upto 2^30, which seem to be quite good for a hash function. That said,

• Is anyone aware of the kind of hash functions that is used by JS engines?

• Is it possible to experimentally create collisions of JavaScript's property accessors?

Spadefish

Answer 1

Is anyone aware of the kind of hash functions that is used by JS engines?

Yes, their developers are certainly aware of the hash functions and the problems they have. In fact, attacks based on hash collisions were demonstrated in 2011 against a variety of languages, among others as a DOS attack againt node.js servers.

The v8 team solved the issue, you can read about the details at https://v8project.blogspot.de/2017/08/about-that-hash-flooding-vulnerability.html.

Is it possible to experimentally create collisions of JavaScript's property accessors?

It appears so: https://github.com/hastebrot/V8-Hash-Collision-Generator

Oldworld