java-topology/defects/julia/patch/julia-deeper-CLEAN.md

Julia — CWE-407 Deeper Scan: CLEAN (beyond julia-0001/julia-0002)

Scan Date

2026-03-29

Areas Scanned

1. Compiler/src/ssair/slot2ssa.jl — visited/seen

• Lines 241, 672: visited = BitSet() — O(1) membership via bit-set.
• Result: CLEAN.

2. Compiler/src/ssair/passes.jl — seen

• Line 140: seen = BitSet(block) — O(1) membership.
• Result: CLEAN.

3. Compiler/src/optimize.jl — visited

• Line 574: visited = BitSet((bb,)) — O(1) membership.
• Result: CLEAN.

4. base/precompilation.jl — visited

• Line 595: visited::Set{PkgId} — O(1) membership in _visit_indirect_deps!.
• Result: CLEAN.

5. base/loading.jl — module loading graph

• loaded_modules is Dict{PkgId,Module} — O(1) lookups throughout.
• Result: CLEAN.

6. base/show.jl — seen

• Line 777: seen = IdSet() — O(1) membership.
• Result: CLEAN.

7. base/Enums.jl — seen

• Line 161: seen = Set{Symbol}() — O(1) membership.
• Result: CLEAN.

8. src/subtype.c / src/typemap.c — C-level type dispatch

• No linear-scan visited/seen arrays. Subtype checking uses a bits-stack, not a list.
• Result: CLEAN.

Conclusion

No CWE-407 defects found beyond julia-0001 (isrelocatable) and julia-0002 (reinfer BFS). All traversal dedup in the Julia Compiler and base library uses Set, IdSet, BitSet, Dict, or IdDict — all O(1) membership.