V8 JavaScript Engine — CWE-407 Analysis
========================================

.. contents:: :local:

Overview
--------

V8 is Google's JavaScript and WebAssembly engine, used in Chrome, Node.js, and Deno.
Its TurboFan and Turboshaft JIT compilers perform SSA construction, CFG analysis,
dominator tree computation, register allocation, and SCC-based loop analysis.

Status: **CLEAN** (scanned 2026-03-23)
---------------------------------------

Scan returned 21 candidates from ``src/compiler``, ``src/codegen``, and ``src/interpreter``.
All triaged as false positives.

Triage Summary
--------------

+----------------------------------------------+-----------------------------------+----------+
| Candidate                                    | Container type                    | Verdict  |
+==============================================+===================================+==========+
| ``all-nodes.h`` ``is_reachable_.Contains``  | ``BitVector`` — bit test          | CLEAN    |
+----------------------------------------------+-----------------------------------+----------+
| ``store-store`` ``active_keys_.Contains``   | ``IntrusiveSet`` — pointer O(1)   | CLEAN    |
+----------------------------------------------+-----------------------------------+----------+
| ``loop-finder.cc`` ``config_.contains``     | bitfield enum flags               | CLEAN    |
+----------------------------------------------+-----------------------------------+----------+
| ``macro-assembler`` ``Contains(tag_range)`` | range check (lo ≤ x ≤ hi)        | CLEAN    |
+----------------------------------------------+-----------------------------------+----------+
| ``turbofan-graph.cc`` ``decorators_`` find  | ``ZoneVector`` ~0–2 items         | FP       |
+----------------------------------------------+-----------------------------------+----------+
| ``string-builder-optimizer`` find pred      | ``SmallVector<BB*,15>`` capped    | FP       |
+----------------------------------------------+-----------------------------------+----------+
| ``wasm-shuffle-reducer`` std::find          | static constexpr array ~8 items   | FP       |
+----------------------------------------------+-----------------------------------+----------+

V8's reachability analysis (``AllNodes``) uses ``BitVector`` for O(1) per-node visited
tracking — one bit per node ID, indexed directly. The Turboshaft store-store elimination
pass uses ``IntrusiveSet`` with an embedded index field in each key object. Both are
idiomatic O(1) membership structures.

The ``std::find`` calls on ``ZoneVector<GraphDecorator*>`` and ``SmallVector<BasicBlock*,15>``
are bounded: decorator vectors are 0–2 elements, the predecessor limit is a hardcoded
constant of 15. Not quadratic in any input.

Key Finding
-----------

V8's JIT compiler infrastructure was written after modern O(1) container idioms were
established in C++ (post-C++11). ``BitVector``, ``ZoneSet``, and ``IntrusiveSet`` are used
uniformly throughout compiler passes. No CWE-407 defect.

References
----------

* Scan result: ``tools/scan-results/v8.txt``
