russell@unturf.com
bb1a6f002f
swift-0001: QualifiedLookupRequest::evaluate (NameLookup.cpp:2860) pushes protocol superclassDecl onto BFS stack unconditionally — visited.insert() return not checked. Nearby ClassDecl arm (line 2833) is correctly guarded. Diamond protocol hierarchies sharing a class superclass trigger O(2^D) re-traversal on every qualified member lookup. Fix: check .second. llvm, gcc, webkit: CLEAN in available sparse-clone code.
25 lines
1.1 KiB
Markdown
25 lines
1.1 KiB
Markdown
# CLEAN — WebKit (JavaScriptCore)
|
|
Scanned 2026-03-30 for CWE-407 diamond recursion (O(2^D)).
|
|
|
|
## Scope
|
|
|
|
Sparse clone: `Source/JavaScriptCore/` — bytecode/, dfg/, b3/ subdirectories
|
|
(390 .cpp files). The `runtime/` directory (prototype chain traversal,
|
|
JSObject hierarchy) is not present in this clone.
|
|
|
|
## Findings
|
|
|
|
- `dfg/DFGValidate.cpp` — uses `seen.add(node).isNewEntry` (WebKit HashSet
|
|
API; isNewEntry == true means newly inserted). Correctly guarded. CLEAN.
|
|
- `dfg/DFGCombinedLiveness.cpp` — `seen.add(node).isNewEntry` guard. CLEAN.
|
|
- `dfg/DFGLiveCatchVariablePreservationPhase.cpp` — `seen.add(predecessor)` with
|
|
`bool isNewEntry` capture and conditional push. CLEAN.
|
|
- `dfg/DFGIntegerRangeOptimizationPhase.cpp` — `m_seenBlocks.add(target)` with
|
|
`if` guard. CLEAN.
|
|
- No WebKit `.add()` without `.isNewEntry` check found in DFG, b3, or
|
|
bytecode paths.
|
|
- `runtime/` (JSObject prototype chain, JSClass hierarchy) not available
|
|
in this sparse clone — cannot confirm absence of defects there.
|
|
|
|
**Result: No actionable O(2^D) diamond defects in available code.
|
|
Note: runtime/ not cloned; prototype chain traversal unverified.**
|