russell@unturf.com
db29a08762
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections. Squash of 94 local commits onto remote master.
34 lines
1.3 KiB
Markdown
34 lines
1.3 KiB
Markdown
---
|
|
id: maven-0002
|
|
repo: maven
|
|
severity: HIGH
|
|
status: PATCHED
|
|
created: 2026-03-23
|
|
patched: 2026-03-23
|
|
patch: defects/maven/patch/maven-0001-0002-vertex-linkedhashset.patch
|
|
---
|
|
|
|
## Defect
|
|
|
|
**File:** `maven-core/src/main/java/org/apache/maven/internal/impl/Graph.java:63-64`
|
|
**Pattern:** duplicate of maven-0001 in different package, `ArrayList.remove()` in `removeEdge`
|
|
**Complexity:** `O(n) per edge removal`
|
|
**Language:** Java
|
|
|
|
## Description
|
|
|
|
This is a duplicate of the same defect present in `maven-0001`, replicated in the `maven.internal.impl` package. The `Graph` class in the internal implementation package independently reimplements the same adjacency-list edge removal using `ArrayList.remove(Object)`. Both copies were likely derived from the same source and carry the same O(n) linear scan defect per edge removal.
|
|
|
|
## Fix
|
|
|
|
**Replace:** `adjacencyList.remove(edge)`
|
|
**With:** `adjacencySet.remove(edge)`
|
|
**Data structure change:** `ArrayList<String> edges → LinkedHashSet<String> edges`
|
|
|
|
## Work required
|
|
|
|
- [ ] Patch in `defects/maven/patch/`
|
|
- [ ] Unit test — asserts exact operation counts before/after (in `defects/maven/unit/`)
|
|
- [ ] Integration test (in `defects/maven/integration/`)
|
|
- [ ] Benchmark — before/after on V=100,200,400,800 (in `defects/maven/bench/`)
|
|
- [ ] White paper section
|