1.7 KiB
Julia — 5-MOAD Scan Notes
Target: Julia programming language (C/C++ runtime, src/ only)
Source: https://github.com/JuliaLang/julia
Scan date: 2026-03-31
Scanner: agent blackops
Summary
| MOAD | Pattern | Result | Defect |
|---|---|---|---|
| 0001 | CWE-407: list/array membership inside loop | DEFECT | julia-0003 |
| 0002 | Intertangle: shared mutable global state | CLEAN | expected design |
| 0003 | Leaked Context: ThreadLocal request-scoped | CLEAN | scope propagates correctly |
| 0004 | CWE-312: credentials logged verbatim | CLEAN | no credential logging in src/ |
| 0005 | Thundering Herd: cache get+null+put without sync | CLEAN | double-check locking used |
MOAD-0001: julia-0003
_typename_add_backedge in src/gf.c:2356-2399 performs two full O(N) linear scans
over the backedges flat array on each insertion. Adding N backedges for a typename
costs O(N²). A TODO comment at line 2379 explicitly acknowledges the linear scan.
See defects/julia/patch/julia-0003-typename-backedge-dedup-linear-scan.md.
Unit test: defects/julia/unit/JuliaBackedgeDedupTest.java — 1/1 PASS (499x ratio at N=500).
MOAD-0002
jl_method_table is a shared global, but all mutations use JL_LOCK/JL_UNLOCK.
This is inherent JIT design, not an Intertangle defect. CLEAN.
MOAD-0003
jl_task_t.scope propagates into child tasks at spawn time (task.c:1135).
This is correct ScopedValue-equivalent behavior. CLEAN.
MOAD-0004
No credential/token/key logging found in src/ C/C++ files. CLEAN.
MOAD-0005
cache_method in gf.c uses double-check locking with typecache_lock before
calling jl_cache_type_(). Our leafcache get+put happens under mc->writelock.
No thundering herd pattern found. CLEAN.