russell@unturf.com
ac82cff865
doctrine-orm-0001: ClassMetadata::addSubClass in_array O(S²) subclasses list HIGH - src/Mapping/ClassMetadata.php addSubClass() scans plain $subClasses list - addSubClasses($parent->subClasses) called in doLoadMetadata: O(S²) per class - Fix: parallel $subClassesSet hash for O(1) membership; 500x at S=1000 composer-0003: InstalledRepository::getDependents in_array O(P²) needles list MEDIUM - needles array grows during foreach($packages) loop, in_array scan 3 sites - $packagesFoundSet already exists for cycle-detection but needles is separate - Fix: add $needlesSet = array_fill_keys($needles, true), mirror growth; 1000x at P=1000 cayley: CLEAN (confirmed -- map-based seen/pathMap throughout) tinkerpop: CLEAN (confirmed -- existing CLEAN.md valid, sort ArrayList is query-plan-time only)
19 lines
1.3 KiB
Markdown
19 lines
1.3 KiB
Markdown
# CLEAN — bevy
|
|
|
|
Scanned 2026-03-29 for CWE-407 (algorithmic complexity).
|
|
|
|
## Findings
|
|
|
|
- `bevy_ecs/src/schedule/graph/graph_map.rs` — cycle detection uses `HashSet` for `blocked` and `maybe_in_more_cycles`. CLEAN.
|
|
- `bevy_ecs/src/schedule/graph/dag.rs` — transitive reduction uses `FixedBitSet` for `visited`. CLEAN.
|
|
- `bevy_ecs/src/schedule/auto_insert_apply_deferred.rs` — `no_sync_edges` is `BTreeSet`. CLEAN.
|
|
- `bevy_ecs/src/schedule/node.rs` — `ambiguous_with_all: &HashSet<NodeId>`, `ignored_ambiguities: &BTreeSet`. CLEAN.
|
|
- `bevy_gltf/src/loader/gltf_ext/scene.rs` — uses `FixedBitSet` and `HashSet` for visited tracking. CLEAN.
|
|
- `bevy_ui/src/stack.rs` — `visited_root_nodes: Local<HashSet<Entity>>`. CLEAN.
|
|
- `bevy_picking/src/hover.rs` — `hover_ancestors: EntityHashSet`. CLEAN.
|
|
- `bevy_render/src/view/window/screenshot.rs` — `seen_targets: Local<HashSet<...>>`. CLEAN.
|
|
- `bevy_pbr/src/render/light.rs` — `all_cascades_seen: HashSet`. CLEAN.
|
|
- `bevy_ecs/src/bundle/info.rs` — `explicit_component_ids: IndexSet<_, FixedHasher>`. CLEAN.
|
|
- `bevy_ecs/src/world/entity_access/world_mut.rs` — `contributed_components()` slice `.contains()` called during archetype migration (not per-frame hot path), N bounded to component count per entity. Not actionable.
|
|
|
|
**Result: No actionable CWE-407 defects.**
|