java-topology/defects/swift/patch/swift-deeper-CLEAN.md

UNDF: UNDF-2026-000000545

Swift Sema deeper scan — CLEAN

Scan date: 2026-03-27 Files scanned:

• lib/Sema/TypeCheckDecl.cpp
• lib/Sema/CSGen.cpp

Findings

lib/Sema/TypeCheckDecl.cpp — CLEAN

Three llvm::find_if / llvm::SmallPtrSet::count calls found:

1. getOriginalParamFromAccessor — single find_if through accessor params, not inside an outer loop. O(P) one-time search.
2. checkPrecedenceCircularity — targets.count() uses llvm::SmallPtrSet which provides O(1) membership. Not a defect.
3. NamingPatternRequest::evaluate — iterates condition elements with containsVarDecl(), not a membership test pattern.

None qualify as CWE-407.

lib/Sema/CSGen.cpp — CLEAN

visitDictionaryExpr has a nested O(n²) double loop over dictionary literal elements (lines 1806–1807), but:

• The inner body calls mergeRepresentativeEquivalenceClasses (union-find), not a linear membership test.
• The subsequent single-pass loop correctly uses llvm::DenseSet<Expr *> (hash set, O(1)) for deduplication via mergedElements.count(element).

The nested loop is an intentional pairwise comparison for constraint merging, not a CWE-407 linear-search-in-loop pattern.

Conclusion

No new CWE-407 defects found in these two files beyond the previously patched swift-0001 and swift-0002.