engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undefect. CWE-407 — 92 sites, 42 ecosystems

Browse source 
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
This commit is contained in:
russell@unturf.com 2026-03-26 19:48:18 -04:00
parent 0a580b313d
commit db29a08762
1311 changed files with 371202 additions and 1188 deletions
Download patch file Download diff file Expand all files Collapse all files

61
defects/v8/patch/v8-0001-register-allocator-spilled-consts-zone-unordered-set.patch Normal file
View file

@ -0,0 +1,61 @@
From: agent-blackops <blackops@unturf.com>
Date: Thu, 26 Mar 2026 00:00:00 +0000
Subject: [PATCH] compiler/backend: replace spilled_consts ZoneVector with ZoneUnorderedSet
CWE-407: Algorithmic complexity via O(k^2) linear scan deduplication in
MeetConstraintsBefore(). spilled_consts was a ZoneVector used only for
membership testing inside an O(inputs) outer loop, producing O(k^2) total
pointer comparisons per instruction when k constant-spill inputs exist.
Replace with ZoneUnorderedSet<TopLevelLiveRange*> for O(1) amortised
membership test and insertion. The constant-spill path is already noted
as "very rare" in the source comment; in pathological cases (e.g., a
function with many identical constant-input SSA values) this can still
materialise as a measurable hot-path.
ZoneUnorderedSet is provided by src/zone/zone-containers.h, already
reachable via register-allocator.h.
Defect-Id: V8-001
Severity: MEDIUM-HIGH
CWE: CWE-407 (Inefficient Algorithmic Complexity)
---
src/compiler/backend/register-allocator.cc | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/src/compiler/backend/register-allocator.cc b/src/compiler/backend/register-allocator.cc
index xxxxxxx..yyyyyyy 100644
--- a/src/compiler/backend/register-allocator.cc
+++ b/src/compiler/backend/register-allocator.cc
@@ -1672,7 +1672,8 @@ void ConstraintBuilder::MeetConstraintsBefore(int instr_index) {
Instruction* second = code()->InstructionAt(instr_index);
// Handle fixed input operands of second instruction.
- ZoneVector<TopLevelLiveRange*>* spilled_consts = nullptr;
+ ZoneUnorderedSet<TopLevelLiveRange*>* spilled_consts = nullptr; // CWE-407 fix
for (size_t i = 0; i < second->InputCount(); i++) {
InstructionOperand* input = second->InputAt(i);
if (input->IsImmediate()) {
@@ -1685,15 +1686,14 @@ void ConstraintBuilder::MeetConstraintsBefore(int instr_index) {
if (range->HasSpillOperand() && range->GetSpillOperand()->IsConstant()) {
bool already_spilled = false;
if (spilled_consts == nullptr) {
- spilled_consts =
- allocation_zone()->New<ZoneVector<TopLevelLiveRange*>>(
- allocation_zone());
+ spilled_consts = // CWE-407 fix
+ allocation_zone()->New<ZoneUnorderedSet<TopLevelLiveRange*>>( // CWE-407 fix
+ allocation_zone()); // CWE-407 fix
} else {
- auto it =
- std::find(spilled_consts->begin(), spilled_consts->end(), range);
- already_spilled = it != spilled_consts->end();
+ already_spilled = spilled_consts->count(range) != 0; // CWE-407 fix: O(1)
}
auto it = data()->slot_for_const_range().find(range);
@@ -1709,7 +1709,7 @@ void ConstraintBuilder::MeetConstraintsBefore(int instr_index) {
data()->AddGapMove(instr_index, Instruction::END, input_copy, *slot);
- spilled_consts->push_back(range);
+ spilled_consts->insert(range); // CWE-407 fix: O(1)
}
}
}