russell@unturf.com bb1a6f002f diamond-scan: llvm/gcc/swift/webkit O(2^D) type hierarchy traversal

swift-0001: QualifiedLookupRequest::evaluate (NameLookup.cpp:2860) pushes
protocol superclassDecl onto BFS stack unconditionally — visited.insert()
return not checked. Nearby ClassDecl arm (line 2833) is correctly guarded.
Diamond protocol hierarchies sharing a class superclass trigger O(2^D)
re-traversal on every qualified member lookup. Fix: check .second.

llvm, gcc, webkit: CLEAN in available sparse-clone code.

2026-03-29 20:19:38 -04:00

1.1 KiB

Raw Blame History

CLEAN — WebKit (JavaScriptCore)

Scanned 2026-03-30 for CWE-407 diamond recursion (O(2^D)).

Scope

Sparse clone: Source/JavaScriptCore/ — bytecode/, dfg/, b3/ subdirectories (390 .cpp files). The runtime/ directory (prototype chain traversal, JSObject hierarchy) is not present in this clone.

Findings

dfg/DFGValidate.cpp — uses seen.add(node).isNewEntry (WebKit HashSet API; isNewEntry == true means newly inserted). Correctly guarded. CLEAN.
dfg/DFGCombinedLiveness.cpp — seen.add(node).isNewEntry guard. CLEAN.
dfg/DFGLiveCatchVariablePreservationPhase.cpp — seen.add(predecessor) with bool isNewEntry capture and conditional push. CLEAN.
dfg/DFGIntegerRangeOptimizationPhase.cpp — m_seenBlocks.add(target) with if guard. CLEAN.
No WebKit .add() without .isNewEntry check found in DFG, b3, or bytecode paths.
runtime/ (JSObject prototype chain, JSClass hierarchy) not available in this sparse clone — cannot confirm absence of defects there.

Result: No actionable O(2^D) diamond defects in available code. Note: runtime/ not cloned; prototype chain traversal unverified.

1.1 KiB Raw Blame History

CLEAN — WebKit (JavaScriptCore)

Scope

Findings

1.1 KiB

Raw Blame History