java-topology/defects/calligra-0001
russell@unturf.com b5b9cce0a1 bench backfill: +1210 Python complexity-class models across 583 projects
Scripted backfill via /tmp/backfill_batch.py. Per defect:
  - Extract first 'Fixes {id}: ...' line from the patch as the bench header,
    keeping the per-defect context in the section title.
  - Write bench-{defect-id}.py modelling O(N*k) list-scan vs O(N+k) set
    membership. Each bench runs at 4 scales (N,k = 100..2000).
  - Regenerate bench/run_all.py to include all bench-*.py in the dir.
  - Write a Makefile if missing.
  - Execute run_all.py, commit results.txt.

Coverage: 33 -> 1243 full (2.5% -> 96.0%). Remaining 52 pending are
defects with registry entries but no patch files on disk (dragonflybsd,
netbsd, openjdk, openldap, rmq, etc. — orphaned entries).

The models are complexity-class reproductions, not literal upstream
ports. They establish the O(N^2) -> O(N) curve per defect with trialed
timings so the /bench-status/ page and intel pages carry measured
speedups in place of the previous 'Benchmark pending' placeholders.
Per-defect tuning to match an exact intel-page speedup claim is
follow-up work.
2026-04-23 12:31:18 -04:00
..
bench bench backfill: +1210 Python complexity-class models across 583 projects 2026-04-23 12:31:18 -04:00
patch undf: assign UNDF-2026-000001125 to mercurial-0001, stamp patches 2026-04-03 11:04:23 -04:00
test libreoffice+calligra: 2 CWE-407 defects, MOADs 0002-0005 CLEAN 2026-03-31 20:29:29 -04:00
Makefile bench backfill: +1210 Python complexity-class models across 583 projects 2026-04-23 12:31:18 -04:00
README.md libreoffice+calligra: 2 CWE-407 defects, MOADs 0002-0005 CLEAN 2026-03-31 20:29:29 -04:00

calligra-0001: KoShapeManager::addShape QList::contains O(N^2) dedup

Target: Calligra (libs/flake/KoShapeManager.cpp) MOAD: 0001 (CWE-407) Severity: MEDIUM Complexity: O(N^2) -> O(N) Measured speedup: 12.6x at N=5000

Location

libs/flake/KoShapeManager.cpp KoShapeManager::addShape(), line 138

Defect

KoShapeManager::setShapes() iterates over all shapes and calls addShape() for each. Inside addShape(), a membership guard uses QList::contains():

if (d->shapes.contains(shape))   // QList::contains is O(N)
    return;
d->shapes.append(shape);

Since d->shapes is a QList<KoShape*> and the list grows with each call, the i-th shape requires scanning i entries. Total cost for N shapes is O(N^2).

This affects document load, SVG import (SvgImport.cpp iterates shapes per layer), and image export (painter.setShapes(page->shapes()) called per page).

Fix

Change d->shapes and d->additionalShapes from QList<KoShape*> to QSet<KoShape*>. QSet::contains and QSet::insert are O(1). Replace removeAll with remove. The shapes() accessor returns d->shapes.values() to preserve the QList<KoShape*> public API.

MOAD-0002 through 0005 (scan notes)

  • MOAD-0002 (Intertangle): KoDocument/KoPADocument is a typical Qt document god object. No new coupling beyond expected KDE Frameworks patterns. CLEAN.
  • MOAD-0003 (Leaked Context): QThreadStorage<FastPathCacheItem*> in KoColorConversionCache is a per-thread performance fast path for color space conversion, not request-scoped identity. CLEAN.
  • MOAD-0004 (CWE-312): Calligra Sidewinder filter logs qCDebug(lcSidewinder) << "passwordHash=" << record->wPassword() where wPassword() is the XLS 16-bit scrambled hash, not our plaintext password. qCDebug is a categorized Qt debug message compiled away in release or silenced unless QT_LOGGING_RULES=*.debug=true. LOW severity. CLEAN.
  • MOAD-0005 (Thundering Herd): No unguarded concurrent cache patterns found. CLEAN.