wave17: postgres-0001/asterisk-0001/haproxy-0001/nginx-0001; postfix+bevy CLEAN

postgres-0001: pg_inherits.c typeInheritsFrom() BFS visited List → HTAB O(1)
asterisk-0001: app_queue.c interface_exists() ao2_iterator walk → ao2_find O(1)
haproxy-0001: http_ana.c cookie-server scan linked-list → eb-tree index O(log S)
nginx-0001: ngx_http_link_multi_headers() O(H²) double-scan → O(H) hash pass
postfix: CLEAN (htable throughout; two marginal LOW admin-bounded candidates)
bevy: CLEAN (FixedBitSet/HashSet throughout; only hardware-bounded marginals)
This commit is contained in:
russell@unturf.com 2026-03-30 07:57:30 -04:00
parent da8b4a41d6
commit ff6292d067
10 changed files with 627 additions and 252 deletions

View file

@ -1,19 +1,15 @@
# CLEAN — bevy
# bevy — CLEAN
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
Scanned 2026-03-30. No CWE-407 defects warranting a patch.
## Findings
Bevy's engineering choices specifically prevent O(N²) patterns:
- ECS schedule tracking: `FixedBitSet` throughout — O(1) contains
- Asset system: `HashSet<AssetPath>` — O(1)
- Plugin deduplication: `HashSet<String>` / `TypeIdMap` (HashMap) — O(1)
- Query/filter building: `FixedBitSet` — O(1)
- GLTF loader: `HashSet` for animation_roots, visited, etc.
- `bevy_ecs/src/schedule/graph/graph_map.rs` — cycle detection uses `HashSet` for `blocked` and `maybe_in_more_cycles`. CLEAN.
- `bevy_ecs/src/schedule/graph/dag.rs` — transitive reduction uses `FixedBitSet` for `visited`. CLEAN.
- `bevy_ecs/src/schedule/auto_insert_apply_deferred.rs` — `no_sync_edges` is `BTreeSet`. CLEAN.
- `bevy_ecs/src/schedule/node.rs` — `ambiguous_with_all: &HashSet<NodeId>`, `ignored_ambiguities: &BTreeSet`. CLEAN.
- `bevy_gltf/src/loader/gltf_ext/scene.rs` — uses `FixedBitSet` and `HashSet` for visited tracking. CLEAN.
- `bevy_ui/src/stack.rs` — `visited_root_nodes: Local<HashSet<Entity>>`. CLEAN.
- `bevy_picking/src/hover.rs` — `hover_ancestors: EntityHashSet`. CLEAN.
- `bevy_render/src/view/window/screenshot.rs` — `seen_targets: Local<HashSet<...>>`. CLEAN.
- `bevy_pbr/src/render/light.rs` — `all_cascades_seen: HashSet`. CLEAN.
- `bevy_ecs/src/bundle/info.rs` — `explicit_component_ids: IndexSet<_, FixedHasher>`. CLEAN.
- `bevy_ecs/src/world/entity_access/world_mut.rs` — `contributed_components()` slice `.contains()` called during archetype migration (not per-frame hot path), N bounded to component count per entity. Not actionable.
**Result: No actionable CWE-407 defects.**
Marginal candidates all bounded by hardware constants or startup-time:
- `bevy_render/slab_allocator.rs:904`: `Vec.iter().position()` in cleanup path; S,V typically 1–5
- `bevy_app/plugin_group.rs:300`: `Vec<TypeId>.iter().find()` on duplicate plugins; startup-only
- `bevy_picking/hover.rs:139`: `Vec<PointerId>.contains()` in retain; P ≤ ~11 hardware pointers