Add 88 new defect entries to HIGH and MEDIUM tables:
HIGH: mysql-0001/0002, mariadb-0001, redis-0001/0002, valkey-0001/0002, openvpn-0001,
vlc-0001, prometheus-0001, otel-collector-0001, cockroachdb-0001..0004,
tidb-0001..0008, kubernetes-0001/0002, go-0001, kotlin-0002, scala-0001,
allegro5-0001, sdl2-0001, grafana-0001, clickhouse-0001, duckdb-0001,
mongodb-0001, envoy-0001, istio-0001, cilium-0001, linkerd2-0001,
linux-0001/0002/0003, tor-0002/0003, curl-0001, julia-0001, lua-0001,
perl5-0001, nats-0001, spring-0003/0004, tomcat-0001, onos-0002, odl-0002
MEDIUM: helm-0001, mariadb-0002, openssl-0001/0002, memcached-0001,
cassandra-0001..0004, flink-0001, storm-0001/0002, zookeeper-0001..0003,
pip-0001, gradle-0001, nginx-0001, haproxy-0001, caddy-0001, varnish-0001,
ffmpeg-0001, gstreamer-0001, raylib-0001, love2d-0001, php-0001/0002,
r-source-0001, cpython-0002, ruby-0001, rabbitmq-0003/0004, activemq-0001,
ovs-0001, onos-0003, odl-0002, jetty-0001
PDF: 976K
1.8 KiB
tidb-0002: mergeInAndNotEQLists removeValues slices.Contains — O(N²)
Severity: MEDIUM File: pkg/planner/core/rule/rule_predicate_simplification.go Line: 267 Status: PATCHED
Description
mergeInAndNotEQLists simplifies NE/IN-list predicate pairs in the planner.
It builds removeValues []int containing predicate indices to remove, then
filters them out:
// O(N²) inner loop builds removeValues
for i := range predicates {
for j := i + 1; j < len(predicates); j++ {
// ... may append i or j to removeValues
}
}
// O(N) loop with O(|removeValues|) check per iteration = O(N²) filter
newValues := make([]expression.Expression, 0, len(predicates))
for i, value := range predicates {
if !(slices.Contains(removeValues, i)) { // O(|removeValues|) scan
newValues = append(newValues, value)
}
}
The O(N²) inner double loop is structural (all pairs must be checked), but the
final filter adds an additional O(N × |removeValues|) pass where a bitset or
map[int]struct{} would make it O(N).
For a query with 100 IN-list predicates, the filter alone performs up to 10 000 index comparisons rather than 100.
Root Cause
removeValues is a []int slice used as a set. slices.Contains performs a
linear scan on every iteration of the output loop.
Fix
Replace removeValues []int with removeSet map[int]struct{}:
removeSet := make(map[int]struct{})
// ... replace: removeValues = append(removeValues, i/j)
// with: removeSet[i] = struct{}{} / removeSet[j] = struct{}{}
newValues := make([]expression.Expression, 0, len(predicates))
for i, value := range predicates {
if _, skip := removeSet[i]; !skip {
newValues = append(newValues, value)
}
}
Speedup
Filter pass: O(N²) → O(N). At N=100 predicates: ~10 000 comparisons → ~100.