Scripted backfill via /tmp/backfill_batch.py. Per defect:
- Extract first 'Fixes {id}: ...' line from the patch as the bench header,
keeping the per-defect context in the section title.
- Write bench-{defect-id}.py modelling O(N*k) list-scan vs O(N+k) set
membership. Each bench runs at 4 scales (N,k = 100..2000).
- Regenerate bench/run_all.py to include all bench-*.py in the dir.
- Write a Makefile if missing.
- Execute run_all.py, commit results.txt.
Coverage: 33 -> 1243 full (2.5% -> 96.0%). Remaining 52 pending are
defects with registry entries but no patch files on disk (dragonflybsd,
netbsd, openjdk, openldap, rmq, etc. — orphaned entries).
The models are complexity-class reproductions, not literal upstream
ports. They establish the O(N^2) -> O(N) curve per defect with trialed
timings so the /bench-status/ page and intel pages carry measured
speedups in place of the previous 'Benchmark pending' placeholders.
Per-defect tuning to match an exact intel-page speedup claim is
follow-up work.
digikam-0003 CWE-407: MetaEngine/DMetadata addToXmpTagStringBag and
removeFromXmpTagStringBag call QStringList::contains() inside a loop over
existing entries — O(O*N) per image during batch metadata write.
Fix: build QSet<QString> before the loop for O(1) lookup.
17x speedup at K=200 keywords (unit test PASS).
digikam-0004 CWE-312: O2::onVerificationReceived logs the full OAuth2
token exchange POST body (including client_secret_) via qDebug() at
GrantFlowAuthorizationCode completion — exposes cloud service credentials
in debug logs/stderr for Google Photos, Flickr, OneDrive integrations.
Fix: replace full-body dump with redacted log line.
lmms: all 5 MOADs CLEAN — std::find uses are non-hot, contains() calls
are on QHash/QMap/QSet, no credential logging, no leaked thread context,
no unsynchronized cache access.
