# IntelliJ IDEA Platform — CWE-407 Scan: CLEAN

**Patterns checked:** O(N²) list membership (visited/seen as ArrayList/LinkedList),
O(2^D) diamond recursion without visited set
**Scan date:** 2026-03-29
**Scope:** `platform/` (core-api, analysis-api, analysis-impl, util, lang-impl,
           xdebugger-api/impl, plugins/kotlin, plugins/groovy, plugins/compose)

## Method

1. Searched `*.java` and `*.kt` for `.contains()` on non-HashSet/LinkedHashSet collections
   in type-hierarchy, annotation-traversal, and supertype contexts.
2. Searched for `visited|seen|ancestors|hierarchy|supertypes` declared as `ArrayList`
   or `LinkedList`.
3. Examined recursive diamond patterns: `processInterfaces`, `getAllSupers`,
   `getIntermediateClassesMemberInfosList`, `addInterfaces`, `iterativeDfs`,
   `traverseGraph`.

## Key candidates reviewed — all CLEAN

### `ReflectionUtil.processInterfaces`
`platform/util/src/com/intellij/util/ReflectionUtil.java` line 73.
`visited` is `Set<? super Class<?>>` initialized as `new HashSet<>()`. CLEAN.

### `InspectionVisitorOptimizer.getAllSupers / addInterfaces`
`platform/analysis-impl/src/.../InspectionVisitorOptimizer.java` line 158.
`supers` is a `HashSet<>()` throughout. CLEAN.

### `AbstractMemberInfoStorage.getIntermediateClassesMemberInfosList`
`platform/lang-impl/src/.../classMembers/AbstractMemberInfoStorage.java` line 100.
`visited` param is `Set<? super C>`, initialized as `new HashSet<>()`. CLEAN.

### `MultiPreviewHelper.iterativeDfs` (Compose plugin)
`plugins/compose/.../MultiPreviewHelper.kt` line 112.
`visitedAnnotationClasses` is `mutableMapOf<String, UElement>()` (HashMap). CLEAN.

### `InferenceUnitGraph.visitTypes / traverseGraph` (Groovy plugin)
`plugins/groovy/.../InferenceUnitGraph.kt` line 30.
`visited` is `mutableSetOf<InferenceUnitNode>()` (LinkedHashSet). CLEAN.

### `KotlinExportedDependenciesCollector` (Kotlin plugin)
`plugins/kotlin/base/fir/.../KotlinExportedDependenciesCollector.kt` line 71.
`visitedModules` is `linkedSetOf<ModuleId>()`. CLEAN.

### `GlobalSearchScopesCore.myDirectories`
`platform/analysis-api/src/.../GlobalSearchScopesCore.java` line 301.
Declared as `Set<? extends VirtualFile>`. CLEAN.

### `XBreakpointType.getVisibleStandardPanels`
`platform/xdebugger-api/src/.../XBreakpointType.java` line 79.
Returns `EnumSet<StandardPanels>` — O(1) contains. CLEAN.

### `WhenChecker.checkedDescriptors / checkedTypes` (Kotlin compiler frontend)
`compiler/frontend/src/.../cfg/WhenChecker.kt` line 190.
`checkedDescriptors = linkedSetOf<ClassDescriptor>()`, `checkedTypes = HashSet<...>()`. CLEAN.

### `OverloadResolver.observedFQNs / reported`
`compiler/frontend/src/.../resolve/OverloadResolver.kt` lines 158, 228.
`hashSetOf<FqNameUnsafe>()` and `HashSet<...>()`. CLEAN.

## Verdict

CLEAN. IntelliJ IDEA platform consistently uses hash-based collections for all
hot-path membership checks. No O(N²) list-as-visited patterns found in any
scanned subsystem. Kotlin/Scala 3 compiler defects are tracked separately under
`defects/kotlin/` and `defects/scala3/`.