java-topology/tools/tickets/defects/javac-0004.md
russell@unturf.com db29a08762 undefect. CWE-407 — 92 sites, 42 ecosystems
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections.
Squash of 94 local commits onto remote master.
2026-03-26 19:48:18 -04:00

1.1 KiB

id repo severity status created
javac-0004 openjdk HIGH patched 2026-03-23

Defect

File: src/jdk.compiler/.../javac/comp/Dependencies.java:197 Pattern: List.contains+add in dependency tracking Complexity: O(M²) Language: Java

Description

The dependency tracker maintains a list of recorded dependencies and guards against duplicates using a List.contains check before each add. This pattern requires a linear scan of the existing dependency list for every new dependency recorded. With M total dependency recording operations, the cumulative cost of all membership checks is O(M²).

Fix

Replace: if (!deps.contains(dep)) deps.add(dep) With: if (depSet.add(dep)) depList.add(dep) Data structure change: List<Dependency> deps → LinkedHashSet<Dependency> deps

Work required

  • Patch in defects/javac/patch/
  • Unit test — asserts exact operation counts before/after (in defects/javac/unit/)
  • Integration test (in defects/javac/integration/)
  • Benchmark — before/after on V=100,200,400,800 (in defects/javac/bench/)
  • White paper section