engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
java-topology/defects/meson/patch/meson-deeper-diamond-CLEAN.md
russell@unturf.com 3986d8dc50 diamond hunt: godot-0009/0010 + meson-0002 + typeorm-0004/0005 + ts-0003; count 629→635 
New diamond recursion defects (O(2^D) → O(N)):
- godot-0009: Font::_is_cyclic no visited set — CJK fallback diamond, 2648x at F=4,D=8
- godot-0010: Font::_update_rids_fb no visited set — duplicate RIDs + O(N^2) hot path
- meson-0002: get_internal_static_libraries_recurse link_whole guard missing — 132x at D=10
- typescript-0003: hasBaseType inner check() no visited set — 1024x at D=10; hot on instanceof

New O(N²) defects:
- typeorm-0004: SubjectTopologicalSorter Array.indexOf dedup — 200x at N=400
- typeorm-0005: DepGraph.createDFS result.indexOf + addDependency edge dedup — 300x at N=600

CLEAN confirmed (diamond recursion sweep): bazel, cargo, cmake, composer, dgl, diesel,
doctrine-orm, efcore, helm, mybatis, networkx-deeper, ninja, npm-arborist, peewee, pip,
rubygems, seaorm, sqlalchemy, swift

UNDF: 571→578 assigned; MOAD count: 629→635
2026-03-29 16:52:04 -04:00

883 B
Raw Blame History

Diamond Recursion Scan — Deeper Scan Notes

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Summary

meson-0002 FOUND in get_internal_static_libraries_recurse (link_whole_targets branch missing visited guard) — see meson-0002-link-whole-diamond-recursion.md.

meson-0001 (existing) covers extra_files dedup O(N²) in process_link_depends.

Other functions checked — CLEAN

  • get_dependencies_recurse (line 1500): has explicit visited set parameter — CLEAN.
  • get_dependencies (line 1485): creates visited set and passes it — CLEAN.
  • get_internal_static_libraries (line 1620): calls get_internal_static_libraries_recurse — DEFECTIVE (meson-0002).
  • build.py dependency resolution: uses OrderedSet throughout for dedup — CLEAN beyond meson-0002.