russell@unturf.com
db29a08762
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections. Squash of 94 local commits onto remote master.
57 lines
2.6 KiB
Markdown
57 lines
2.6 KiB
Markdown
---
|
|
id: scan/minecraft-server
|
|
repo: Mojang/minecraft-java-edition
|
|
version: 26.1 (server-26.1.jar, extracted from server.jar bundler)
|
|
scanned: 2026-03-24
|
|
source: ~/Downloads/server.jar (bundler) → META-INF/versions/26.1/server-26.1.jar
|
|
method: CFR decompiler + bytecode string scan for List/contains patterns
|
|
---
|
|
|
|
## Summary
|
|
|
|
7,351 classes scanned. 2 confirmed defects. Core graph utilities are CLEAN.
|
|
|
|
## Confirmed defects
|
|
|
|
| ID | Class | Pattern | Severity |
|
|
|----|-------|---------|----------|
|
|
| minecraft-0001 | `util/DependencySorter.isCyclic` | Recursive DFS with no visited set — exponential on diamond dependency graphs | HIGH |
|
|
| minecraft-0002 | `world/level/block/piston/PistonStructureResolver` | `List<BlockPos>.contains()` in push chain loop | LOW (bounded at 12) |
|
|
|
|
## Confirmed CLEAN
|
|
|
|
| Class | Why clean |
|
|
|-------|-----------|
|
|
| `util/Graph.depthFirstSearch` | Uses `Set<T>` for both `discovered` and `currentlyVisiting` — O(1) contains |
|
|
| `util/FeatureSorter` | Uses `TreeSet` for visited/onStack — O(log n), deliberate for deterministic ordering |
|
|
| `util/DependencySorter.visitDependenciesAndElement` | Uses `HashSet alreadyVisited` — O(1) |
|
|
| `world/level/lighting/DynamicGraphMinFixedPoint` | No list containers in bytecode |
|
|
| `world/level/chunk/status/ChunkDependencies` | No list containers in bytecode |
|
|
|
|
## Notes
|
|
|
|
- Minecraft Java Edition is NOT open source. Analysis is from decompiled bytecode.
|
|
- CFR decompiler used (cfr-0.152.jar).
|
|
- Obfuscated field/method names are NOT remapped (no mappings applied). Class names
|
|
are unobfuscated in recent versions (Mojang releases class name mappings).
|
|
- Disclosure path: bugs.mojang.com (public bug tracker).
|
|
|
|
## minecraft-0001 detail
|
|
|
|
`DependencySorter.isCyclic` performs a recursive DFS to check if adding an edge
|
|
would create a cycle. No `visited` set. For a diamond graph of depth D, node count
|
|
is 2^D. Called from `TagLoader` — runs on every world load and `/reload`.
|
|
|
|
Large modpacks (Create, Applied Energistics 2, Mekanism, Thermal Expansion) with
|
|
thousands of cross-mod tag dependencies hit this on every server start. The "tag
|
|
loading lag" reported by modpack server operators is consistent with this behavior.
|
|
|
|
## Broader scan note
|
|
|
|
34 classes had the `ArrayList + contains` bytecode signature. Most are either:
|
|
- Bounded inputs (piston: max 12, pack selection: tens of packs)
|
|
- Non-hot paths (advancement layout, crash report categories)
|
|
- Using `contains` on a `HolderSet` (Minecraft's own set wrapper, likely O(1))
|
|
|
|
The DependencySorter defect is the only site where unbounded graph traversal
|
|
occurs without visited tracking.
|