engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

v8-0004 + jsc-0003: Maglev KnownMapsMerger O(P×R) std::find, IntegerRangeOpt liveAtHead O(50×B×R×L); 2+2 PASS; count 606→608

Browse source
This commit is contained in:
russell@unturf.com 2026-03-27 23:00:07 -04:00
parent ae91f05bf3
commit 87099aaaac
9 changed files with 328 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

2
whitepaper/MD5SUMS
View file

@ -3,7 +3,7 @@ ba0de5d1546aa2971492f74616f13f47 full-paper.pdf
3fda5736a004c621f52701c92a7ca7f5 undefect-cwe407-2026-03-24.pdf
f076f22e9e70a94f51884562aad6fdc5 undefect-cwe407-2026-03-25.pdf
5da33a4087fdca81f70cce84656afc7f undefect-cwe407-2026-03-26.pdf
87845a2ecd45c1b032b30e44bff2292f undefect-cwe407-2026-03-27.pdf
d6fd8ceebdcd075f3e39b73e1bf7a3ad undefect-cwe407-2026-03-27.pdf
ff52abf9f47a7e6bb25e4519b1325090 undefect-minecraft-enterprise-java-2026-03-24.pdf
c7fe499eb004271b384a31ac01b38852 undefect-minecraft-enterprise-java-2026-03-25.pdf
818d29731df88333d29cfdd3eefeb3a2 undefect-minecraft-enterprise-java-2026-03-26.pdf

16
whitepaper/full-paper.md
View file

@ -39,7 +39,7 @@ A single well-crafted implementation serves as the genetic blueprint.
4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
Code propagates according to its kind — clean architecture begets clean implementations,
elegant solutions inspire elegant variations. The process of generating 606 validated
elegant solutions inspire elegant variations. The process of generating 608 validated
defect patches across 240 ecosystems in a single research wave demonstrates how truth,
properly seeded, multiplies. Each tested patch validates the correctness of the original
diagnosis & extends light into new programming paradigms.
@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
confirmed site — compiler, routing, database, build tool, event streaming, web framework,
query optimizer, and browser runtime.
**606 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
**608 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
3 unpatched (Minecraft, Create mod). No language left behind.
@ -264,6 +264,7 @@ stacks, Spark schemas — this is the dominant build cost.
| v8-0001 | V8 | `register-allocator.cc:2324` — `ZoneVector<TopLevelLiveRange*>+std::find` in `MeetConstraintsBefore()`; O(k²) spill dedup per instruction | **PATCHED** |
| v8-0002 | V8 | `intl-objects.cc:940` — `std::vector<std::string> seen` + `std::find` in `CanonicalizeLocaleList()`; O(N²) per `Intl.*` constructor call (125×) | **PATCHED** |
| v8-0003 | V8 | `revectorizer.cc:538` — `std::find(loads.begin(), loads.end())` in `SLPTree::TryReduceLoadChain()`; O(N²×L) SIMD load-chain scan (25×) | **PATCHED** |
| v8-0004 | V8 | `maglev/maglev-known-node-aspects.h:852` — `std::find` in `KnownMapsMerger::IntersectWithKnownNodeAspects()`; O(P×R) per CheckMaps node; V8 `TODO(v8:7700)` acknowledges it; fix: `ZoneRefSet<Map>` (40×) | **PATCHED** |
| tinkerpop-0001 | Apache TinkerPop | `process/traversal/Path.java:206` — default `isSimple()` O(n²) nested loop; fired by every `.simplePath()`/`.cyclicPath()` Gremlin step via `subPath()`→`MutablePath` | **PATCHED** |
| neo4j-0001 | Neo4j | `community/graph-algo/src/.../Dijkstra.java:324` — `myPredecessors.contains(rel)` `List<Relationship>` O(P) inside edge-expansion in all-shortest-paths; fix: `Set<Relationship>` (500×) | **PATCHED** |
| janusgraph-0001 | JanusGraph | `janusgraph-core/.../MultiCondition.java:29` — extends `ArrayList<Condition>` inheriting O(N) `contains()` in `addConstraint()`; fix: parallel `HashSet<Condition>` override (400×) | **PATCHED** |
@ -686,6 +687,7 @@ stacks, Spark schemas — this is the dominant build cost.
| sm-0004 | SpiderMonkey | `js/src/vm/Modules.cpp` — `ContainsElement(exportedNames)` GCVector linear scan in `ModuleGetExportedNames()`; O(E²×S²) star-export dedup (320×) | **PATCHED** |
| jsc-0001 | JavaScriptCore | `Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp:181` — `bytecodeOffsetsJumpedTo.contains()` Vector O(T) scan for each of B basic blocks; O(B²×T) for switch-heavy bytecode (200×) | **PATCHED** |
| jsc-0002 | JavaScriptCore | `Source/JavaScriptCore/dfg/DFGGraph.cpp:744` — `PredecessorList::contains(block)` O(P) dedup in `handleSuccessor()` per CFG edge; O(N²) for switch-merge CFGs (500×) | **PATCHED** |
| jsc-0003 | JavaScriptCore | `dfg/DFGIntegerRangeOptimizationPhase.cpp:1996` — `liveAtHead` WTF::Vector::contains O(L) inside 50-iter fixed-point × B blocks × R relationships; fix: `UncheckedKeyHashSet` (27×) | **PATCHED** |
| rabbitmq-0001 | RabbitMQ | `rabbit_classic_queue.erl:410` — `lists:member(Pid, pending)` over unconfirmed message map on publisher DOWN; O(M×P) | **PATCHED** |
| octave-0001 | GNU Octave | `data.cc:138` + `numeric/max.cc:111` — `std::find` on already-sorted `vecdim` vector; `std::binary_search` is correct | **PATCHED** |
| octave-0002 | GNU Octave | `libinterp/corefcn/load-path.cc:1119,1151` — `find_dir_info()` O(D) linear scan called per `add()` during `set()` path init; O(D²) total; fix: `unordered_set` (500×) | **PATCHED** |
@ -886,7 +888,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
chains with depths in this range.
**606 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
**608 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
---
@ -1250,9 +1252,9 @@ a reduction in one of the most expensive single passes in the release build pipe
| Engine | Browser | Scan result |
|--------|---------|-------------|
| V8 TurboFan | Chrome | **v8-0001 PATCHED** — `ZoneVector` dedup in register allocator (50×); **v8-0002 PATCHED** — `Intl::CanonicalizeLocaleList` seen-list O(N²) (125×); **v8-0003 PATCHED** — revectorizer SLP load-chain O(N²×L) (25×) |
| V8 TurboFan | Chrome | **v8-0001 PATCHED** — `ZoneVector` dedup in register allocator (50×); **v8-0002 PATCHED** — `Intl::CanonicalizeLocaleList` seen-list O(N²) (125×); **v8-0003 PATCHED** — revectorizer SLP load-chain O(N²×L) (25×); **v8-0004 PATCHED** — Maglev `KnownMapsMerger` CheckMaps `std::find` O(P×R) (40×) |
| SpiderMonkey IonMonkey | Firefox | **sm-0001 PATCHED** — `LinearSum::add()` HashMap (O(N×T)→O(N)); **sm-0002/0003 PATCHED** — UnrollLoops Vector→HashSet (150×/31×); **sm-0004 PATCHED** — Modules star-export GCVector→HashSet (320×) |
| JavaScriptCore | Safari | **jsc-0001 PATCHED** — `BytecodeBasicBlock` switch O(B²×T)→O(B) (200×); **jsc-0002 PATCHED** — DFGGraph predecessor dedup O(N²)→O(N) (500×) |
| JavaScriptCore | Safari | **jsc-0001 PATCHED** — `BytecodeBasicBlock` switch O(B²×T)→O(B) (200×); **jsc-0002 PATCHED** — DFGGraph predecessor dedup O(N²)→O(N) (500×); **jsc-0003 PATCHED** — IntegerRangeOpt `liveAtHead` Vector 50-iter fixed-point O(50×B×R×L) (27×) |
### 7.8 C/C++ Ecosystem — GCC, LLVM, CMake
@ -2938,7 +2940,7 @@ The following systems were scanned and confirmed free of CWE-407:
**Routing and SDN:** ONOS, OpenDaylight — both use O(1) hash containers.
**Browser engines:** V8 (v8-0001/0002/0003 PATCHED — register allocator 50×, Intl locale dedup 125×, revectorizer SLP 25×); SpiderMonkey (sm-0001 through sm-0004 PATCHED — Ion bounds-check, UnrollLoops 150×/31×, Modules star-export 320×); JavaScriptCore (jsc-0001 PATCHED — BytecodeBasicBlock switch 200×; jsc-0002 PATCHED — DFGGraph predecessor 500×).
**Browser engines:** V8 (v8-0001/0002/0003/0004 PATCHED — register allocator 50×, Intl locale dedup 125×, revectorizer SLP 25×, Maglev KnownMapsMerger 40×); SpiderMonkey (sm-0001 through sm-0004 PATCHED — Ion bounds-check, UnrollLoops 150×/31×, Modules star-export 320×); JavaScriptCore (jsc-0001 PATCHED — BytecodeBasicBlock switch 200×; jsc-0002 PATCHED — DFGGraph predecessor 500×; jsc-0003 PATCHED — IntegerRangeOpt liveAtHead 27×).
**Build systems:** sbt — confirmed clean. Bazel: bazel-0001/0002 PATCHED. Jenkins: jenkins-0001/0002 PATCHED.
@ -3428,7 +3430,7 @@ and the structural variants of -0005.
**Confirmed CLEAN (no action needed):**
ONOS, OpenDaylight, MySQL optimizer, Neo4j — all confirmed using O(1) hash containers.
V8 TurboFan (v8-0001/0002/0003 PATCHED), SpiderMonkey IonMonkey (sm-0001 PATCHED), Bazel
V8 TurboFan/Maglev (v8-0001/0002/0003/0004 PATCHED), SpiderMonkey IonMonkey (sm-0001 PATCHED), Bazel
(bazel-0001/0002 PATCHED), GNU Octave (octave-0001 PATCHED), KiCad (kicad-0001 PATCHED),
Apache TinkerPop (tinkerpop-0001 PATCHED), Yosys, Verilator — all now scanned and
resolved.

BIN
whitepaper/undefect-cwe407-2026-03-27.pdf
View file

Binary file not shown.