UNDF: UNDF-2026-000000374

dart-0002: SSA builder namedParameters.contains() in .where() filter — O(N²)

Severity

MEDIUM

Location

pkg/compiler/lib/src/ssa/builder.dart Line 2156 (function _buildNativeInvoke or similar native method handler)

Description

In the SSA builder's native method handling, a .where() filter over functionNode.namedParameters calls function.parameterStructure.namedParameters.contains(p.name) to decide which parameters to retain. The predicate runs once per item in the outer list, and each call to .contains() scans the List<String> linearly. The result is O(N²) where N is the number of named parameters.

Defective Code

// pkg/compiler/lib/src/ssa/builder.dart:2151–2163
if (functionNode.namedParameters.isNotEmpty) {
  List<ir.VariableDeclaration> namedParameters = functionNode
      .namedParameters
      // Filter elided parameters.
      .where(
        (p) => function.parameterStructure.namedParameters.contains(p.name),  // O(N) per element
      )
      .toList();
  namedParameters.sort(nativeOrdering);
  namedParameters.forEach(handleParameter);
}

Fix

// FIXED
if (functionNode.namedParameters.isNotEmpty) {
  final Set<String> liveNames =
      function.parameterStructure.namedParameters.toSet();          // O(N) once
  List<ir.VariableDeclaration> namedParameters = functionNode
      .namedParameters
      .where((p) => liveNames.contains(p.name))                      // O(1) per element
      .toList();
  namedParameters.sort(nativeOrdering);
  namedParameters.forEach(handleParameter);
}

Complexity

	Before	After
Per function	O(N²)	O(N)

dart-0001: same root cause in element_map.dart
dart-0003: same pattern at builder.dart:5007

1.8 KiB Raw Blame History Unescape Escape