diff --git a/defects/forgejo-0002/patch/forgejo-0002.patch b/defects/forgejo-0002/patch/forgejo-0002.patch new file mode 100644 index 000000000..bcc6349c8 --- /dev/null +++ b/defects/forgejo-0002/patch/forgejo-0002.patch @@ -0,0 +1,27 @@ +--- a/modules/repository/init.go ++++ b/modules/repository/init.go +@@ -104,13 +104,16 @@ func LoadRepoConfig() error { + + // Filter out invalid names and promote preferred licenses. ++ // Build a set for O(1) lookups to avoid O(P*L) and O(L*P) scans. ++ licensesSet := make(map[string]struct{}, len(Licenses)) ++ for _, name := range Licenses { ++ licensesSet[strings.ToLower(name)] = struct{}{} ++ } ++ preferredSet := make(map[string]struct{}, len(setting.Repository.PreferredLicenses)) ++ for _, name := range setting.Repository.PreferredLicenses { ++ preferredSet[strings.ToLower(name)] = struct{}{} ++ } + sortedLicenses := make([]string, 0, len(Licenses)) + for _, name := range setting.Repository.PreferredLicenses { +- if util.SliceContainsString(Licenses, name, true) { ++ if _, ok := licensesSet[strings.ToLower(name)]; ok { + sortedLicenses = append(sortedLicenses, name) + } + } + for _, name := range Licenses { +- if !util.SliceContainsString(setting.Repository.PreferredLicenses, name, true) { ++ if _, ok := preferredSet[strings.ToLower(name)]; !ok { + sortedLicenses = append(sortedLicenses, name) + } + } diff --git a/defects/forgejo-0002/test/ForgejoLicenseSortTest.class b/defects/forgejo-0002/test/ForgejoLicenseSortTest.class new file mode 100644 index 000000000..de7022bc8 Binary files /dev/null and b/defects/forgejo-0002/test/ForgejoLicenseSortTest.class differ diff --git a/defects/forgejo-0002/test/ForgejoLicenseSortTest.java b/defects/forgejo-0002/test/ForgejoLicenseSortTest.java new file mode 100644 index 000000000..165f32102 --- /dev/null +++ b/defects/forgejo-0002/test/ForgejoLicenseSortTest.java @@ -0,0 +1,157 @@ +import java.util.*; + +/** + * Unit test simulating Forgejo forgejo-0002: + * modules/repository/init.go LoadRepoConfig() license sort uses O(P*L) scans: + * + * for _, name := range setting.Repository.PreferredLicenses { + * if util.SliceContainsString(Licenses, name, true) { // O(L) scan + * sortedLicenses = append(sortedLicenses, name) + * } + * } + * for _, name := range Licenses { + * if !util.SliceContainsString(setting.Repository.PreferredLicenses, name, true) { // O(P) scan + * sortedLicenses = append(sortedLicenses, name) + * } + * } + * + * Forgejo ships 776 licenses. Any preferred list of P entries costs O(P*776 + 776*P). + * Fix: build sets for O(1) lookup before the loops. + */ +public class ForgejoLicenseSortTest { + + // Defective: O(P*L + L*P) + static List sortLicensesDefective( + List allLicenses, List preferred) { + List sorted = new ArrayList<>(allLicenses.size()); + for (String name : preferred) { + if (containsIgnoreCase(allLicenses, name)) { + sorted.add(name); + } + } + for (String name : allLicenses) { + if (!containsIgnoreCase(preferred, name)) { + sorted.add(name); + } + } + return sorted; + } + + static boolean containsIgnoreCase(List list, String target) { + String t = target.toLowerCase(Locale.ROOT); + for (String s : list) { + if (s.toLowerCase(Locale.ROOT).equals(t)) return true; + } + return false; + } + + // Fixed: build sets first, then O(P + L) + static List sortLicensesFixed( + List allLicenses, List preferred) { + Set licenseSet = new HashSet<>(allLicenses.size() * 2); + for (String s : allLicenses) licenseSet.add(s.toLowerCase(Locale.ROOT)); + + Set preferredSet = new HashSet<>(preferred.size() * 2); + for (String s : preferred) preferredSet.add(s.toLowerCase(Locale.ROOT)); + + List sorted = new ArrayList<>(allLicenses.size()); + for (String name : preferred) { + if (licenseSet.contains(name.toLowerCase(Locale.ROOT))) { + sorted.add(name); + } + } + for (String name : allLicenses) { + if (!preferredSet.contains(name.toLowerCase(Locale.ROOT))) { + sorted.add(name); + } + } + return sorted; + } + + static long countDefectiveOps(List allLicenses, List preferred) { + long ops = 0; + // First loop: P * L + for (String name : preferred) { + ops += allLicenses.size(); + } + // Second loop: L * P + for (String name : allLicenses) { + ops += preferred.size(); + } + return ops; + } + + static long countFixedOps(List allLicenses, List preferred) { + // Build sets: O(L + P) + long ops = allLicenses.size() + preferred.size(); + // Two loops: O(P + L) + ops += preferred.size() + allLicenses.size(); + return ops; + } + + // Build a realistic license list like Forgejo's 776 licenses + static List makeLicenses(int count) { + List licenses = new ArrayList<>(count); + String[] templates = { + "MIT", "Apache-2.0", "GPL-2.0", "GPL-3.0", "LGPL-2.1", + "BSD-2-Clause", "BSD-3-Clause", "ISC", "MPL-2.0", "CDDL-1.0" + }; + for (int i = 0; i < count; i++) { + licenses.add(templates[i % templates.length] + "-variant-" + i); + } + return licenses; + } + + public static void main(String[] args) { + System.out.println("forgejo-0002: LoadRepoConfig license sort O(P*L) -> O(P+L)"); + System.out.println("=".repeat(60)); + + // Correctness test with small data + List licenses = Arrays.asList( + "MIT", "Apache-2.0", "GPL-2.0", "GPL-3.0", "BSD-2-Clause" + ); + List preferred = Arrays.asList("GPL-3.0", "MIT"); + + List defective = sortLicensesDefective(licenses, preferred); + List fixed = sortLicensesFixed(licenses, preferred); + + // Both should start with preferred items (in preferred order), rest follow + if (!defective.get(0).equals("GPL-3.0") || !defective.get(1).equals("MIT")) { + throw new AssertionError("Defective sort wrong ordering: " + defective); + } + if (!fixed.get(0).equals("GPL-3.0") || !fixed.get(1).equals("MIT")) { + throw new AssertionError("Fixed sort wrong ordering: " + fixed); + } + if (defective.size() != fixed.size()) { + throw new AssertionError("Size mismatch: " + defective.size() + " vs " + fixed.size()); + } + System.out.println("PASS: correctness verified"); + + // Benchmark: 776 licenses (realistic), various preferred counts + System.out.printf("%n%-10s %15s %12s %10s%n", + "licenses", "defective_ops", "fixed_ops", "ratio"); + System.out.println("-".repeat(48)); + + int L = 776; + List allLicenses = makeLicenses(L); + int[] prefCounts = {1, 5, 10, 20}; + for (int P : prefCounts) { + List pref = allLicenses.subList(0, P); + long def = countDefectiveOps(allLicenses, pref); + long fix = countFixedOps(allLicenses, pref); + double ratio = (double) def / fix; + System.out.printf("L=%-4d P=%-4d %15d %12d %9.1fx%n", L, P, def, fix, ratio); + } + + long def776 = countDefectiveOps(allLicenses, allLicenses.subList(0, 5)); + long fix776 = countFixedOps(allLicenses, allLicenses.subList(0, 5)); + double ratio776 = (double) def776 / fix776; + + if (ratio776 < 4) { + throw new AssertionError("Expected >4x ratio at L=776, P=5, got " + ratio776); + } + + System.out.println("\nAll assertions PASS"); + System.out.println("Fix: build licensesSet and preferredSet before loops for O(1) lookup"); + } +} diff --git a/defects/forgejo-0003/patch/forgejo-0003.patch b/defects/forgejo-0003/patch/forgejo-0003.patch new file mode 100644 index 000000000..0c4f8b443 --- /dev/null +++ b/defects/forgejo-0003/patch/forgejo-0003.patch @@ -0,0 +1,47 @@ +--- a/models/asymkey/ssh_key.go ++++ b/models/asymkey/ssh_key.go +@@ -378,19 +378,22 @@ func synchronizePublicKeys(ctx context.Context, s *auth.Source, usr *user_model. + // Process the provided keys to remove duplicates and name part +- var providedKeys []string ++ providedKeysSet := make(map[string]struct{}) ++ var providedKeys []string + for _, v := range sshPublicKeys { + sshKeySplit := strings.Split(v, " ") + if len(sshKeySplit) > 1 { + key := strings.Join(sshKeySplit[:2], " ") +- if !util.SliceContainsString(providedKeys, key) { ++ if _, exists := providedKeysSet[key]; !exists { ++ providedKeysSet[key] = struct{}{} + providedKeys = append(providedKeys, key) + } + } + } + + // Check if Public Key sync is needed +@@ -399,14 +402,16 @@ func synchronizePublicKeys(ctx context.Context, s *auth.Source, usr *user_model. + + // Add new Public SSH Keys that doesn't already exist in DB ++ giteaKeysSet := make(map[string]struct{}, len(giteaKeys)) ++ for _, k := range giteaKeys { ++ giteaKeysSet[k] = struct{}{} ++ } + var newKeys []string + for _, key := range providedKeys { +- if !util.SliceContainsString(giteaKeys, key) { ++ if _, exists := giteaKeysSet[key]; !exists { + newKeys = append(newKeys, key) + } + } + if AddPublicKeysBySource(ctx, usr, s, newKeys) { + sshKeysNeedUpdate = true + } + + // Mark keys from DB that no longer exist in the source for deletion + var giteaKeysToDelete []string + for _, giteaKey := range giteaKeys { +- if !util.SliceContainsString(providedKeys, giteaKey) { ++ if _, exists := providedKeysSet[giteaKey]; !exists { + log.Trace("synchronizePublicKeys[%s]: Marking Public SSH Key for deletion for user %s: %v", s.Name, usr.Name, giteaKey) + giteaKeysToDelete = append(giteaKeysToDelete, giteaKey) + } + } diff --git a/defects/forgejo-0003/test/ForgejoSSHKeySyncTest.class b/defects/forgejo-0003/test/ForgejoSSHKeySyncTest.class new file mode 100644 index 000000000..8879062cd Binary files /dev/null and b/defects/forgejo-0003/test/ForgejoSSHKeySyncTest.class differ diff --git a/defects/forgejo-0003/test/ForgejoSSHKeySyncTest.java b/defects/forgejo-0003/test/ForgejoSSHKeySyncTest.java new file mode 100644 index 000000000..cdb96e6aa --- /dev/null +++ b/defects/forgejo-0003/test/ForgejoSSHKeySyncTest.java @@ -0,0 +1,179 @@ +import java.util.*; + +/** + * Unit test simulating Forgejo forgejo-0003: + * models/asymkey/ssh_key.go synchronizePublicKeys() has three O(N*M) scans: + * + * 1. Building providedKeys with dedup: O(K^2) where K = LDAP-provided key count + * for _, v := range sshPublicKeys { + * key = ... + * if !util.SliceContainsString(providedKeys, key) { // O(|providedKeys|) each time + * + * 2. Finding new keys: O(P * G) where P = provided, G = DB keys + * for _, key := range providedKeys { + * if !util.SliceContainsString(giteaKeys, key) { // O(G) each + * + * 3. Finding deleted keys: O(G * P) + * for _, giteaKey := range giteaKeys { + * if !util.SliceContainsString(providedKeys, giteaKey) { // O(P) each + * + * This runs per user per LDAP sync cycle. With many users or large key sets it accumulates. + * Fix: build maps for O(1) lookup before each loop. + */ +public class ForgejoSSHKeySyncTest { + + // Defective: O(K^2) dedup + O(P*G) + O(G*P) + static long countDefectiveOps(int rawKeyCount, int giteaKeyCount) { + // Phase 1: dedup raw keys into providedKeys + // Assume half are unique: K/2 unique keys, K/2 duplicates + // Each insertion checks against growing list + long ops = 0; + int provided = 0; + for (int i = 0; i < rawKeyCount; i++) { + ops += provided; // SliceContainsString cost + if (i % 2 == 0) provided++; // ~half unique + } + // Phase 2: find new keys (provided not in gitea) + ops += (long) provided * giteaKeyCount; + // Phase 3: find keys to delete (gitea not in provided) + ops += (long) giteaKeyCount * provided; + return ops; + } + + static long countFixedOps(int rawKeyCount, int giteaKeyCount) { + // Phase 1: dedup with set — O(K) total + long ops = rawKeyCount; + int provided = rawKeyCount / 2; // ~half unique + // Build giteaKeysSet: O(G) + ops += giteaKeyCount; + // Phase 2: find new keys — O(P) + ops += provided; + // Phase 3: find keys to delete — O(G) + ops += giteaKeyCount; + return ops; + } + + // Simulate the sync logic for correctness + static Map> syncKeysDefective( + List rawKeys, List giteaKeys) { + // Dedup rawKeys + List provided = new ArrayList<>(); + for (String k : rawKeys) { + if (!provided.contains(k)) { + provided.add(k); + } + } + // Find new keys + List toAdd = new ArrayList<>(); + for (String k : provided) { + if (!giteaKeys.contains(k)) { + toAdd.add(k); + } + } + // Find keys to delete + List toDelete = new ArrayList<>(); + for (String k : giteaKeys) { + if (!provided.contains(k)) { + toDelete.add(k); + } + } + Map> result = new HashMap<>(); + result.put("toAdd", toAdd); + result.put("toDelete", toDelete); + return result; + } + + static Map> syncKeysFixed( + List rawKeys, List giteaKeys) { + // Dedup rawKeys with set + Set providedSet = new LinkedHashSet<>(); + List provided = new ArrayList<>(); + for (String k : rawKeys) { + if (providedSet.add(k)) { + provided.add(k); + } + } + // Build giteaKeys set + Set giteaSet = new HashSet<>(giteaKeys); + // Find new keys + List toAdd = new ArrayList<>(); + for (String k : provided) { + if (!giteaSet.contains(k)) { + toAdd.add(k); + } + } + // Find keys to delete + List toDelete = new ArrayList<>(); + for (String k : giteaKeys) { + if (!providedSet.contains(k)) { + toDelete.add(k); + } + } + Map> result = new HashMap<>(); + result.put("toAdd", toAdd); + result.put("toDelete", toDelete); + return result; + } + + public static void main(String[] args) { + System.out.println("forgejo-0003: synchronizePublicKeys() O(K^2+P*G) -> O(K+P+G)"); + System.out.println("=".repeat(60)); + + // Correctness test + List rawKeys = Arrays.asList( + "ssh-rsa AAAA1", "ssh-rsa AAAA2", "ssh-rsa AAAA1", // dup + "ssh-rsa AAAA3", "ssh-rsa AAAA2" // more dups + ); + List giteaKeys = Arrays.asList( + "ssh-rsa AAAA2", "ssh-rsa AAAA4" + ); + + Map> def = syncKeysDefective(rawKeys, giteaKeys); + Map> fix = syncKeysFixed(rawKeys, giteaKeys); + + // Expected: add AAAA1 and AAAA3 (new from LDAP), delete AAAA4 (no longer in LDAP) + List expectedAdd = Arrays.asList("ssh-rsa AAAA1", "ssh-rsa AAAA3"); + List expectedDelete = Arrays.asList("ssh-rsa AAAA4"); + + if (!def.get("toAdd").equals(expectedAdd)) { + throw new AssertionError("Defective toAdd wrong: " + def.get("toAdd")); + } + if (!def.get("toDelete").equals(expectedDelete)) { + throw new AssertionError("Defective toDelete wrong: " + def.get("toDelete")); + } + if (!fix.get("toAdd").equals(expectedAdd)) { + throw new AssertionError("Fixed toAdd wrong: " + fix.get("toAdd")); + } + if (!fix.get("toDelete").equals(expectedDelete)) { + throw new AssertionError("Fixed toDelete wrong: " + fix.get("toDelete")); + } + System.out.println("PASS: correctness verified"); + + // Performance comparison + System.out.printf("%n%-20s %15s %12s %10s%n", + "scenario", "defective_ops", "fixed_ops", "ratio"); + System.out.println("-".repeat(58)); + + int[][] scenarios = { + {10, 10}, {50, 50}, {100, 100}, {500, 500}, {1000, 1000} + }; + for (int[] sc : scenarios) { + int K = sc[0], G = sc[1]; + long dOps = countDefectiveOps(K, G); + long fOps = countFixedOps(K, G); + double ratio = (double) dOps / fOps; + System.out.printf("K=%-4d G=%-4d %15d %12d %9.1fx%n", + K, G, dOps, fOps, ratio); + } + + long dOps = countDefectiveOps(500, 500); + long fOps = countFixedOps(500, 500); + double ratio = (double) dOps / fOps; + if (ratio < 10) { + throw new AssertionError("Expected >10x ratio at K=500 G=500, got " + ratio); + } + + System.out.println("\nAll assertions PASS"); + System.out.println("Fix: use providedKeysSet(map) for O(1) dedup; giteaKeysSet for O(1) diff"); + } +} diff --git a/defects/langchain-0001/patch/langchain-0001.patch b/defects/langchain-0001/patch/langchain-0001.patch new file mode 100644 index 000000000..b05a70c0c --- /dev/null +++ b/defects/langchain-0001/patch/langchain-0001.patch @@ -0,0 +1,32 @@ +--- a/libs/langchain/langchain_classic/retrievers/multi_vector.py ++++ b/libs/langchain/langchain_classic/retrievers/multi_vector.py +@@ -105,9 +105,10 @@ class MultiVectorRetriever(BaseRetriever): + sub_docs = self.vectorstore.similarity_search(query, **self.search_kwargs) + + # We do this to maintain the order of the IDs that are returned +- ids = [] ++ seen_ids: set = set() ++ ids = [] + for d in sub_docs: +- if self.id_key in d.metadata and d.metadata[self.id_key] not in ids: ++ if self.id_key in d.metadata and d.metadata[self.id_key] not in seen_ids: ++ seen_ids.add(d.metadata[self.id_key]) + ids.append(d.metadata[self.id_key]) + docs = self.docstore.mget(ids) + return [d for d in docs if d is not None] +@@ -147,9 +148,10 @@ class MultiVectorRetriever(BaseRetriever): + sub_docs = await self.vectorstore.asimilarity_search( + query, **self.search_kwargs + ) + + # We do this to maintain the order of the IDs that are returned +- ids = [] ++ seen_ids_async: set = set() ++ ids = [] + for d in sub_docs: +- if self.id_key in d.metadata and d.metadata[self.id_key] not in ids: ++ if self.id_key in d.metadata and d.metadata[self.id_key] not in seen_ids_async: ++ seen_ids_async.add(d.metadata[self.id_key]) + ids.append(d.metadata[self.id_key]) + docs = await self.docstore.amget(ids) + return [d for d in docs if d is not None] diff --git a/defects/langchain-0001/test/LangChainMultiVectorDedupTest.class b/defects/langchain-0001/test/LangChainMultiVectorDedupTest.class new file mode 100644 index 000000000..4a43070eb Binary files /dev/null and b/defects/langchain-0001/test/LangChainMultiVectorDedupTest.class differ diff --git a/defects/langchain-0001/test/LangChainMultiVectorDedupTest.java b/defects/langchain-0001/test/LangChainMultiVectorDedupTest.java new file mode 100644 index 000000000..161bb60bd --- /dev/null +++ b/defects/langchain-0001/test/LangChainMultiVectorDedupTest.java @@ -0,0 +1,151 @@ +import java.util.*; + +/** + * Unit test simulating LangChain langchain-0001: + * MultiVectorRetriever._get_relevant_documents() uses a list for ID dedup: + * ids = [] + * for d in sub_docs: + * if id_key in d.metadata and d.metadata[id_key] not in ids: + * ids.append(d.metadata[id_key]) + * + * "id not in ids" is O(|ids|) per document, making the full dedup O(k^2) + * where k = number of sub-docs from vectorstore search. + * Fix: use a set for O(1) membership, keeping ids list for order preservation. + */ +public class LangChainMultiVectorDedupTest { + + // Defective: O(k^2) list-based dedup + static List dedupList(List subDocIds) { + List ids = new ArrayList<>(); + for (String id : subDocIds) { + if (!ids.contains(id)) { // O(|ids|) scan + ids.add(id); + } + } + return ids; + } + + // Fixed: O(k) set-assisted dedup, preserving order + static List dedupSet(List subDocIds) { + Set seen = new LinkedHashSet<>(); + List ids = new ArrayList<>(); + for (String id : subDocIds) { + if (seen.add(id)) { // O(1) amortized + ids.add(id); + } + } + return ids; + } + + // Measure operation count for list-based dedup + static long countListOps(List subDocIds) { + List ids = new ArrayList<>(); + long ops = 0; + for (String id : subDocIds) { + ops += ids.size(); // each contains() scans whole list + if (!ids.contains(id)) { + ids.add(id); + } + } + return ops; + } + + // Measure operation count for set-based dedup + static long countSetOps(List subDocIds) { + Set seen = new HashSet<>(); + long ops = 0; + for (String id : subDocIds) { + ops += 1; // O(1) hash lookup + seen.add(id); + } + return ops; + } + + // Simulate sub_docs where each doc has an id pointing to a parent document + // k sub-docs may map to fewer unique parent ids (many-to-one) + static List makeSubDocIds(int k, int uniqueParents) { + Random rng = new Random(42); + List ids = new ArrayList<>(k); + for (int i = 0; i < k; i++) { + ids.add("parent-" + (rng.nextInt(uniqueParents))); + } + return ids; + } + + static void append(List list, String val) { + list.add(val); + } + + // Override dedupList to use add not append + static List dedupListFixed(List subDocIds) { + List ids = new ArrayList<>(); + for (String id : subDocIds) { + if (!ids.contains(id)) { + ids.add(id); + } + } + return ids; + } + + public static void main(String[] args) { + System.out.println("langchain-0001: MultiVectorRetriever ID dedup O(k^2) -> O(k)"); + System.out.println("=".repeat(60)); + + // Test correctness + List input = Arrays.asList( + "p1", "p2", "p1", "p3", "p2", "p4", "p1" + ); + List expected = Arrays.asList("p1", "p2", "p3", "p4"); + + List listResult = dedupListFixed(input); + List setResult = dedupSet(input); + + if (!listResult.equals(expected)) { + throw new AssertionError("List dedup wrong: " + listResult); + } + if (!setResult.equals(expected)) { + throw new AssertionError("Set dedup wrong: " + setResult); + } + System.out.println("PASS: both produce correct ordered dedup"); + + // Benchmark comparison at various k values + System.out.printf("%n%-8s %12s %12s %10s%n", + "k", "list_ops", "set_ops", "ratio"); + System.out.println("-".repeat(44)); + + int[] kValues = {10, 50, 100, 500, 1000}; + for (int k : kValues) { + // Worst case: all unique ids (no duplicates) maximizes list scan ops + List allUnique = new ArrayList<>(k); + for (int i = 0; i < k; i++) allUnique.add("p" + i); + + long listOps = countListOps(allUnique); + long setOps = countSetOps(allUnique); + double ratio = (double) listOps / setOps; + + System.out.printf("%-8d %12d %12d %9.1fx%n", k, listOps, setOps, ratio); + + if (k >= 100 && ratio < 40) { + throw new AssertionError("Expected >40x ratio at k=" + k + ", got " + ratio); + } + } + + // Realistic scenario: k=100 sub-docs mapping to 20 unique parents + int k = 100, parents = 20; + List realistic = makeSubDocIds(k, parents); + long listOpsR = countListOps(realistic); + long setOpsR = countSetOps(realistic); + double ratioR = (double) listOpsR / setOpsR; + System.out.printf("%nRealistic k=%d, %d parents: list=%d set=%d ratio=%.1fx%n", + k, parents, listOpsR, setOpsR, ratioR); + + if (ratioR < 5) { + throw new AssertionError("Expected >5x ratio in realistic case, got " + ratioR); + } + + System.out.println("\nAll assertions PASS"); + System.out.println("Fix: replace 'ids = []; id not in ids' with set-assisted dedup"); + System.out.println(" seen_ids = set()"); + System.out.println(" if id not in seen_ids: seen_ids.add(id); ids.append(id)"); + } +}