russell@unturf.com
3986d8dc50
New diamond recursion defects (O(2^D) → O(N)): - godot-0009: Font::_is_cyclic no visited set — CJK fallback diamond, 2648x at F=4,D=8 - godot-0010: Font::_update_rids_fb no visited set — duplicate RIDs + O(N^2) hot path - meson-0002: get_internal_static_libraries_recurse link_whole guard missing — 132x at D=10 - typescript-0003: hasBaseType inner check() no visited set — 1024x at D=10; hot on instanceof New O(N²) defects: - typeorm-0004: SubjectTopologicalSorter Array.indexOf dedup — 200x at N=400 - typeorm-0005: DepGraph.createDFS result.indexOf + addDependency edge dedup — 300x at N=600 CLEAN confirmed (diamond recursion sweep): bazel, cargo, cmake, composer, dgl, diesel, doctrine-orm, efcore, helm, mybatis, networkx-deeper, ninja, npm-arborist, peewee, pip, rubygems, seaorm, sqlalchemy, swift UNDF: 571→578 assigned; MOAD count: 629→635
1.7 KiB
Diamond Recursion Scan (npm-arborist) — CLEAN
Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))
Files examined
lib/can-place-dep.js— peer dependency placement and cycle detectionlib/calc-dep-flags.js— dev/optional/peer flag propagationlib/node.js—explain(),getBundler(),isDescendantOf()lib/edge.js—explain()lib/gather-dep-set.js— transitive dep set computation
Findings
can-place-dep.js: Already contains a CWE-407 fix (npm-0002, peerPathSet as new Set()). O(1) membership checks. CLEAN.
calc-dep-flags.js: calcDepFlagsStep delegates tree traversal to treeverse.depth() which manages visited tracking internally. The self-call in the function body handles only node.isLink (pointer-following, not a DAG diamond). CLEAN.
node.js explain(): Uses this[_explanation] memoization cache so a node is fully computed only once regardless of how many paths in the DAG reach it. The seen.includes(this) (Array.includes) guards against cycle re-entry. The memoization ensures O(N) total work, not O(2^D). CLEAN.
node.js getBundler(): Traverses the parent chain upward (a tree, not a DAG), then iterates edgesIn. Uses a shared path array with path.includes() as cycle guard. The path array is passed by reference and grows monotonically, acting as an implicit visited set across sibling iterations. Not a diamond recursion defect.
gather-dep-set.js: Uses iterative Set-based BFS with deps.has() O(1) membership test. CLEAN.