russell@unturf.com 7786adc4c0 ruffle: 2 CWE-407 defects, MOADs 0002-0005 documented ... ruffle-0001: AVM2 optimizer type_aware.rs process_jump() worklist dedup Vec<usize>.contains() inside while-loop over basic blocks -> O(B^2). Fix: companion HashSet<usize> for O(1) dedup. 249.5x at fanWidth=500. ruffle-0002: MovieClip goto_commands depth lookup O(F*D^2) -> O(F*D). goto_place_object/goto_remove_object use iter().position(|o| o.depth()==d) inside frame-scan while-loop. Fix: HashMap<Depth, usize> index alongside Vec; swap_remove displacement handled correctly. 51.5x at F=500 D=100. MOAD-0002 (Intertangle): UpdateContext god-object couples GC/AVM1/AVM2/ audio/video/renderer/navigator/UI/storage/log/timers/input in one struct. Architectural, not a single-patch fix. MOAD-0003 (Leaked Context): CURRENT_CONTEXT thread_local in web/src/lib.rs holds raw *mut UpdateContext<'static> (request-scoped in thread scope). Desktop thread_locals CALLSTACK/RENDER_INFO/SWF_INFO carry per-SWF state. MOAD-0004: CLEAN. No verbatim credential logging found. MOAD-0005: CLEAN. Arc<Mutex<Player>> used consistently, no unsynchronized cache double-check pattern. 2/2 unit tests PASS.		2026-03-31 19:57:30 -04:00
..
ruffle-0002.patch	ruffle: 2 CWE-407 defects, MOADs 0002-0005 documented	2026-03-31 19:57:30 -04:00