engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/intellij/patch/CLEAN.md
russell@unturf.com 3f5ce0d264 jvm-langs: intellij platform CLEAN; kotlin/scala3 defects already committed 
IntelliJ IDEA platform scan CLEAN — all hot-path membership checks use HashSet/
LinkedHashSet/EnumSet throughout: ReflectionUtil.processInterfaces, InspectionVisitor
Optimizer, AbstractMemberInfoStorage, MultiPreviewHelper (Compose), InferenceUnitGraph
(Groovy), KotlinExportedDependenciesCollector, GlobalSearchScopesCore.myDirectories.
No O(N²) list-as-visited patterns found.

kotlin-0001/0002 and scala3-0001 patch docs already landed in 068ebbd29f.
2026-03-29 19:58:14 -04:00

3 KiB
Raw Blame History

IntelliJ IDEA Platform — CWE-407 Scan: CLEAN

Patterns checked: O(N²) list membership (visited/seen as ArrayList/LinkedList), O(2^D) diamond recursion without visited set Scan date: 2026-03-29 Scope: platform/ (core-api, analysis-api, analysis-impl, util, lang-impl, xdebugger-api/impl, plugins/kotlin, plugins/groovy, plugins/compose)

Method

  1. Searched *.java and *.kt for .contains() on non-HashSet/LinkedHashSet collections in type-hierarchy, annotation-traversal, and supertype contexts.
  2. Searched for visited|seen|ancestors|hierarchy|supertypes declared as ArrayList or LinkedList.
  3. Examined recursive diamond patterns: processInterfaces, getAllSupers, getIntermediateClassesMemberInfosList, addInterfaces, iterativeDfs, traverseGraph.

Key candidates reviewed — all CLEAN

ReflectionUtil.processInterfaces

platform/util/src/com/intellij/util/ReflectionUtil.java line 73. visited is Set<? super Class<?>> initialized as new HashSet<>(). CLEAN.

InspectionVisitorOptimizer.getAllSupers / addInterfaces

platform/analysis-impl/src/.../InspectionVisitorOptimizer.java line 158. supers is a HashSet<>() throughout. CLEAN.

AbstractMemberInfoStorage.getIntermediateClassesMemberInfosList

platform/lang-impl/src/.../classMembers/AbstractMemberInfoStorage.java line 100. visited param is Set<? super C>, initialized as new HashSet<>(). CLEAN.

MultiPreviewHelper.iterativeDfs (Compose plugin)

plugins/compose/.../MultiPreviewHelper.kt line 112. visitedAnnotationClasses is mutableMapOf<String, UElement>() (HashMap). CLEAN.

InferenceUnitGraph.visitTypes / traverseGraph (Groovy plugin)

plugins/groovy/.../InferenceUnitGraph.kt line 30. visited is mutableSetOf<InferenceUnitNode>() (LinkedHashSet). CLEAN.

KotlinExportedDependenciesCollector (Kotlin plugin)

plugins/kotlin/base/fir/.../KotlinExportedDependenciesCollector.kt line 71. visitedModules is linkedSetOf<ModuleId>(). CLEAN.

GlobalSearchScopesCore.myDirectories

platform/analysis-api/src/.../GlobalSearchScopesCore.java line 301. Declared as Set<? extends VirtualFile>. CLEAN.

XBreakpointType.getVisibleStandardPanels

platform/xdebugger-api/src/.../XBreakpointType.java line 79. Returns EnumSet<StandardPanels> — O(1) contains. CLEAN.

WhenChecker.checkedDescriptors / checkedTypes (Kotlin compiler frontend)

compiler/frontend/src/.../cfg/WhenChecker.kt line 190. checkedDescriptors = linkedSetOf<ClassDescriptor>(), checkedTypes = HashSet<...>(). CLEAN.

OverloadResolver.observedFQNs / reported

compiler/frontend/src/.../resolve/OverloadResolver.kt lines 158, 228. hashSetOf<FqNameUnsafe>() and HashSet<...>(). CLEAN.

Verdict

CLEAN. IntelliJ IDEA platform consistently uses hash-based collections for all hot-path membership checks. No O(N²) list-as-visited patterns found in any scanned subsystem. Kotlin/Scala 3 compiler defects are tracked separately under defects/kotlin/ and defects/scala3/.