Verilator — CWE-407 Analysis
==============================

.. contents:: :local:

Overview
--------

Verilator is the fastest open-source Verilog/SystemVerilog simulator. It compiles
RTL designs to multithreaded C++. Internally it performs design analysis, data-flow
graph construction, critical-path scheduling, and SCC detection for combinational
loop identification.

**Status: CLEAN — 0 confirmed defects**

Scanner returned 3 candidates; all are false positives on hash-backed containers.

Triage
------

.. list-table::
   :header-rows: 1
   :widths: 35 30 20 15

   * - Candidate
     - Container type
     - Membership cost
     - Verdict
   * - ``V3ExecGraph.cpp:955`` — ``schedule.contains(nextp)`` in edge loop
     - ``ThreadSchedule`` (internal hash set)
     - O(1)
     - FALSE POSITIVE
   * - ``V3Gate.cpp:722`` — ``readVscps.count(varScp)`` in out-edge loop
     - ``std::unordered_set`` / ``VNumRange``
     - O(1)
     - FALSE POSITIVE
   * - ``V3Options.h:724`` — ``m_fDfgPeepholeDisabled.count(name)``
     - ``VStringSet`` (``std::set<std::string>``)
     - O(log n); not in hot loop
     - FALSE POSITIVE

All three candidates are O(1) or O(log n) hash/set lookups — not O(n) linear scans.

Design Assessment
-----------------

Verilator's graph algorithms use proper O(1) membership containers throughout:

- **V3Graph**: node/edge traversal with pointer-based identity, no list membership
- **V3Partition** (multithreading scheduler): ``std::unordered_set<ExecMTask*>``
  for all visited-set tracking
- **SCC detection** (combinational loop finder): ``std::unordered_set`` for
  on-stack and visited state — correct O(1) membership
- **V3Gate** (gate optimization): ``std::unordered_set`` for variable scope sets

References
----------

* Scanner: ``tools/scans/verilator.sh``
* Scan result: ``tools/scan-results/verilator.txt`` — 3 candidates, all false positives
