russell@unturf.com
3f5ce0d264
IntelliJ IDEA platform scan CLEAN — all hot-path membership checks use HashSet/
LinkedHashSet/EnumSet throughout: ReflectionUtil.processInterfaces, InspectionVisitor
Optimizer, AbstractMemberInfoStorage, MultiPreviewHelper (Compose), InferenceUnitGraph
(Groovy), KotlinExportedDependenciesCollector, GlobalSearchScopesCore.myDirectories.
No O(N²) list-as-visited patterns found.
kotlin-0001/0002 and scala3-0001 patch docs already landed in 068ebbd29f.
66 lines
3 KiB
Markdown
66 lines
3 KiB
Markdown
# IntelliJ IDEA Platform — CWE-407 Scan: CLEAN
|
|
|
|
**Patterns checked:** O(N²) list membership (visited/seen as ArrayList/LinkedList),
|
|
O(2^D) diamond recursion without visited set
|
|
**Scan date:** 2026-03-29
|
|
**Scope:** `platform/` (core-api, analysis-api, analysis-impl, util, lang-impl,
|
|
xdebugger-api/impl, plugins/kotlin, plugins/groovy, plugins/compose)
|
|
|
|
## Method
|
|
|
|
1. Searched `*.java` and `*.kt` for `.contains()` on non-HashSet/LinkedHashSet collections
|
|
in type-hierarchy, annotation-traversal, and supertype contexts.
|
|
2. Searched for `visited|seen|ancestors|hierarchy|supertypes` declared as `ArrayList`
|
|
or `LinkedList`.
|
|
3. Examined recursive diamond patterns: `processInterfaces`, `getAllSupers`,
|
|
`getIntermediateClassesMemberInfosList`, `addInterfaces`, `iterativeDfs`,
|
|
`traverseGraph`.
|
|
|
|
## Key candidates reviewed — all CLEAN
|
|
|
|
### `ReflectionUtil.processInterfaces`
|
|
`platform/util/src/com/intellij/util/ReflectionUtil.java` line 73.
|
|
`visited` is `Set<? super Class<?>>` initialized as `new HashSet<>()`. CLEAN.
|
|
|
|
### `InspectionVisitorOptimizer.getAllSupers / addInterfaces`
|
|
`platform/analysis-impl/src/.../InspectionVisitorOptimizer.java` line 158.
|
|
`supers` is a `HashSet<>()` throughout. CLEAN.
|
|
|
|
### `AbstractMemberInfoStorage.getIntermediateClassesMemberInfosList`
|
|
`platform/lang-impl/src/.../classMembers/AbstractMemberInfoStorage.java` line 100.
|
|
`visited` param is `Set<? super C>`, initialized as `new HashSet<>()`. CLEAN.
|
|
|
|
### `MultiPreviewHelper.iterativeDfs` (Compose plugin)
|
|
`plugins/compose/.../MultiPreviewHelper.kt` line 112.
|
|
`visitedAnnotationClasses` is `mutableMapOf<String, UElement>()` (HashMap). CLEAN.
|
|
|
|
### `InferenceUnitGraph.visitTypes / traverseGraph` (Groovy plugin)
|
|
`plugins/groovy/.../InferenceUnitGraph.kt` line 30.
|
|
`visited` is `mutableSetOf<InferenceUnitNode>()` (LinkedHashSet). CLEAN.
|
|
|
|
### `KotlinExportedDependenciesCollector` (Kotlin plugin)
|
|
`plugins/kotlin/base/fir/.../KotlinExportedDependenciesCollector.kt` line 71.
|
|
`visitedModules` is `linkedSetOf<ModuleId>()`. CLEAN.
|
|
|
|
### `GlobalSearchScopesCore.myDirectories`
|
|
`platform/analysis-api/src/.../GlobalSearchScopesCore.java` line 301.
|
|
Declared as `Set<? extends VirtualFile>`. CLEAN.
|
|
|
|
### `XBreakpointType.getVisibleStandardPanels`
|
|
`platform/xdebugger-api/src/.../XBreakpointType.java` line 79.
|
|
Returns `EnumSet<StandardPanels>` — O(1) contains. CLEAN.
|
|
|
|
### `WhenChecker.checkedDescriptors / checkedTypes` (Kotlin compiler frontend)
|
|
`compiler/frontend/src/.../cfg/WhenChecker.kt` line 190.
|
|
`checkedDescriptors = linkedSetOf<ClassDescriptor>()`, `checkedTypes = HashSet<...>()`. CLEAN.
|
|
|
|
### `OverloadResolver.observedFQNs / reported`
|
|
`compiler/frontend/src/.../resolve/OverloadResolver.kt` lines 158, 228.
|
|
`hashSetOf<FqNameUnsafe>()` and `HashSet<...>()`. CLEAN.
|
|
|
|
## Verdict
|
|
|
|
CLEAN. IntelliJ IDEA platform consistently uses hash-based collections for all
|
|
hot-path membership checks. No O(N²) list-as-visited patterns found in any
|
|
scanned subsystem. Kotlin/Scala 3 compiler defects are tracked separately under
|
|
`defects/kotlin/` and `defects/scala3/`.
|