[8u] RFR: 8203190: SessionId.hashCode generates too many collisions

Severin Gehwolf sgehwolf at redhat.com
Thu May 16 17:51:25 UTC 2019


Hi,

Could I please get a review of this OpenJDK 8u only fix? JDKs 11+ don't
seems to have this issue as with the TLS 1.3 feature (JDK-8196584)
SessionId.hashCode() got changed to use Arrays.hashCode() already.

webrev: http://cr.openjdk.java.net/~sgehwolf/webrevs/JDK-8203190/01/webrev/
Bug: https://bugs.openjdk.java.net/browse/JDK-8203190

The rationale for the fix are these assumptions:

a) elements in trees on hash collision of LinkedHashMap used internally
by the MemoryCache class become prohibitively large for many SessionId
entries in the cache, b) moderate speed of the new hashCode() impl will
not have a detrimental effect on performance overall.

Comparison of performance of hashCode impls[1]:

Benchmark                    Mode  Cnt         Score         Error  Units
SessionIDBench.newHashCode  thrpt  100  43649538.284 ±  678702.696  ops/s
SessionIDBench.oldHashCode  thrpt  100  94068843.923 ± 1379930.266  ops/s

Collision testing[2] showed that indeed, the current hashCode()
implementation of SessionId produces more collissions and, thus,
produce more elements in trees for collision resolution in the
underlying LinkedHashMap. The default cache expiry is 24 hours per
entry and this can result in millions of entries in the cache in some
circumstances[3].

Before:
##################################################
Collision test for 100 sessions:
------------------------------------------------
Total number of collisions: 4
Max length of collision list over all buckets: 2

Collision test for 20480 sessions:
------------------------------------------------
Total number of collisions: 18311
Max length of collision list over all buckets: 30

Collision test for 10000000 sessions:
------------------------------------------------
Total number of collisions: 9996395
Max length of collision list over all buckets: 9709
##################################################

After:
##################################################
Collision test for 100 sessions:
------------------------------------------------
Total number of collisions: 0

Collision test for 20480 sessions:
------------------------------------------------
Total number of collisions: 0

Collision test for 10000000 sessions:
------------------------------------------------
Total number of collisions: 11530
Max length of collision list over all buckets: 2
##################################################


Testing: Above testing, and make test. No new failures.

Thoughts?

Thanks,
Severin

[1] http://cr.openjdk.java.net/~sgehwolf/webrevs/JDK-8203190/SessionIDBench.java
[2] http://cr.openjdk.java.net/~sgehwolf/webrevs/JDK-8203190/SessionIdCollissionTest.java
[3] https://bugs.openjdk.java.net/browse/JDK-8210985




More information about the security-dev mailing list