russell@unturf.com
3986d8dc50
New diamond recursion defects (O(2^D) → O(N)): - godot-0009: Font::_is_cyclic no visited set — CJK fallback diamond, 2648x at F=4,D=8 - godot-0010: Font::_update_rids_fb no visited set — duplicate RIDs + O(N^2) hot path - meson-0002: get_internal_static_libraries_recurse link_whole guard missing — 132x at D=10 - typescript-0003: hasBaseType inner check() no visited set — 1024x at D=10; hot on instanceof New O(N²) defects: - typeorm-0004: SubjectTopologicalSorter Array.indexOf dedup — 200x at N=400 - typeorm-0005: DepGraph.createDFS result.indexOf + addDependency edge dedup — 300x at N=600 CLEAN confirmed (diamond recursion sweep): bazel, cargo, cmake, composer, dgl, diesel, doctrine-orm, efcore, helm, mybatis, networkx-deeper, ninja, npm-arborist, peewee, pip, rubygems, seaorm, sqlalchemy, swift UNDF: 571→578 assigned; MOAD count: 629→635
16 lines
713 B
Markdown
16 lines
713 B
Markdown
# doctrine-orm diamond recursion scan — CLEAN
|
|
|
|
Scanned: 2026-03-29
|
|
Scope: diamond recursion / CWE-407 in ORM dependency graph traversal
|
|
|
|
## Files checked
|
|
|
|
- `src/Internal/TopologicalSort.php` — DFS with 3-state coloring (NOT_VISITED / IN_PROGRESS / VISITED);
|
|
uses `$this->states` array indexed by `spl_object_id()` for O(1) visited check. Clean.
|
|
- `src/Internal/StronglyConnectedComponents.php` — Tarjan SCC with visited arrays. Clean.
|
|
- `src/UnitOfWork.php` — delegates to `TopologicalSort` for insert/delete ordering. Clean.
|
|
|
|
## Verdict
|
|
|
|
CLEAN. All graph traversal uses proper visited-state tracking with O(1) lookups.
|
|
No diamond recursion pattern (unbounded recursion without a visited accumulator).
|