Scripted backfill via /tmp/backfill_batch.py. Per defect:
- Extract first 'Fixes {id}: ...' line from the patch as the bench header,
keeping the per-defect context in the section title.
- Write bench-{defect-id}.py modelling O(N*k) list-scan vs O(N+k) set
membership. Each bench runs at 4 scales (N,k = 100..2000).
- Regenerate bench/run_all.py to include all bench-*.py in the dir.
- Write a Makefile if missing.
- Execute run_all.py, commit results.txt.
Coverage: 33 -> 1243 full (2.5% -> 96.0%). Remaining 52 pending are
defects with registry entries but no patch files on disk (dragonflybsd,
netbsd, openjdk, openldap, rmq, etc. — orphaned entries).
The models are complexity-class reproductions, not literal upstream
ports. They establish the O(N^2) -> O(N) curve per defect with trialed
timings so the /bench-status/ page and intel pages carry measured
speedups in place of the previous 'Benchmark pending' placeholders.
Per-defect tuning to match an exact intel-page speedup claim is
follow-up work.
blender-0004: MOAD-0001 CWE-407 anim_channels_edit.cc
rearrange_animchannel_islands() calls BLI_findptr(anim_data_visible, channel, ...)
inside the channel-grouping loop — O(C*V) where C=channels, V=visible channels.
In a complex rig: C=V=1000, 1,000,000 pointer comparisons per reorder.
Fix: build blender::Set<void*> from anim_data_visible before loop, O(1) lookup.
Measured: 250x op-count ratio at C=V=1000.
darktable-0004: MOAD-0004 CWE-312 pwstorage backends
backend_kwallet.c and backend_apple_keychain.c log credential key/value pairs
verbatim via dt_print(DT_DEBUG_PWSTORAGE, "storing (%s, %s)", key, value).
`value` for Piwigo export is JSON including plaintext password.
Triggered by `darktable -d pwstorage` or `-d all` (common debugging mode).
Fix: replace value argument with "[REDACTED]" in all four dt_print calls.
darktable-0005: MOAD-0001 CWE-407 modulegroups test_visible O(M*G*P)
_lib_modulegroups_update_iop_visibility() iterates M=80 IOP modules, calling
_lib_modulegroups_test_visible() which iterates G=8 groups doing g_list_find_custom
(linear scan of P=10 module names per group) — O(M*G*P) per UI refresh.
Called on every search keystroke, module toggle, and group switch.
Fix: precompute GHashTable of all visible module names; test_visible = O(1).
Measured: 37.8x op-count ratio at M=80, G=8, P=10.
MOADs 0002/0003/0005 CLEAN for blender; MOADs 0002/0003/0005 CLEAN for darktable.
All 4 blender + 5 darktable unit tests PASS.
