java-topology/tools/tickets/defects/gyp-0001.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.2 KiB

id repo severity status created
gyp-0001 gyp MEDIUM PATCHED 2026-03-23

Defect

File: pylib/gyp/input.py:1604 Pattern: child in path list membership + .index() in DFS cycle detection Complexity: O(V²) Language: Python

Description

GYP's DFS-based cycle detection maintains the current path as a Python list and checks for back-edges using child in path (a linear scan). When a cycle is found, .index() is called on the same list to find the cycle start, which is another linear scan. Both operations are O(path length), and since they are performed for every edge in the dependency graph, the total cost is O(V²) in the number of targets.

Fix

Replace: child in path and path.index(child) With: child in path_set and path_index[child] Data structure change: path: list → path: list + path_set: set + path_index: dict

Work required

  • Patch in defects/gyp/patch/gyp-0001-path-set.patch `
  • Unit test — asserts exact operation counts before/after (in defects/gyp/unit/)
  • Integration test (in defects/gyp/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/gyp/bench/)
  • White paper section