Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted [v2]

2023-01-27 Thread j3graham
On Fri, 27 Jan 2023 13:53:45 GMT, Glavo wrote: >> I checked the `java.base` module, and all the `Collection#toArray()` method >> of collections be implemented correctly. >> >> Their return values can be trusted, so many unnecessary array duplication >> can be eliminated. > > Glavo has updated

Re: RFR: 8299807: newStringNoRepl should avoid copying arrays for ASCII compatible charsets

2023-01-27 Thread Glavo
On Fri, 27 Jan 2023 16:04:41 GMT, Roger Riggs wrote: >> This is the javadoc of `JavaLangAccess::newStringNoRepl`: >> >> >> /** >> * Constructs a new {@code String} by decoding the specified subarray of >> * bytes using the specified {@linkplain java.nio.charset.Charset >>

Re: RFR: 8299807: newStringNoRepl should avoid copying arrays for ASCII compatible charsets

2023-01-27 Thread Roger Riggs
On Fri, 20 Jan 2023 16:47:27 GMT, Glavo wrote: > This is the javadoc of `JavaLangAccess::newStringNoRepl`: > > > /** > * Constructs a new {@code String} by decoding the specified subarray of > * bytes using the specified {@linkplain java.nio.charset.Charset > charset}. > *

Re: RFR: 8299807: newStringNoRepl should avoid copying arrays for ASCII compatible charsets

2023-01-27 Thread Glavo
On Fri, 20 Jan 2023 16:47:27 GMT, Glavo wrote: > This is the javadoc of `JavaLangAccess::newStringNoRepl`: > > > /** > * Constructs a new {@code String} by decoding the specified subarray of > * bytes using the specified {@linkplain java.nio.charset.Charset > charset}. > *

RFR: 8299807: newStringNoRepl should avoid copying arrays for ASCII compatible charsets

2023-01-27 Thread Glavo
This is the javadoc of `JavaLangAccess::newStringNoRepl`: /** * Constructs a new {@code String} by decoding the specified subarray of * bytes using the specified {@linkplain java.nio.charset.Charset charset}. * * The caller of this method shall relinquish and transfer the

Why does ZipFile.Source.readFullyAt read in chunks?

2023-01-27 Thread Eirik Bjørsnøs
Hi, ZipFile.Source.readFullyAt caps its calls to RandomAccessFile.readFully to a maximum of 8192 bytes per call, like this: int N = len; > while (N > 0) { > int n = Math.min(BUF_SIZE, N); > zfile.readFully(buf, off, n); > off += n; > N -= n; > } I'm observing a ~10% speedup of

Integrated: 8300140: ZipFile.isSignatureRelated returns true for files in META-INF subdirectories

2023-01-27 Thread Eirik Bjorsnos
On Thu, 12 Jan 2023 18:44:26 GMT, Eirik Bjorsnos wrote: > Some call sites of SignatureFileVerifier.isBlockOrSF fails to check that > files reside in META-INF directly, and not in a subdirectory of META-INF. > > The mentioned call sites needs updates to check and ignore such files. > > A new

Integrated: Merge jdk20

2023-01-27 Thread Jesper Wilhelmsson
On Fri, 27 Jan 2023 21:00:03 GMT, Jesper Wilhelmsson wrote: > Forwardport JDK 20 -> JDK 21 This pull request has now been integrated. Changeset: 5c59de52 Author:Jesper Wilhelmsson URL: https://git.openjdk.org/jdk/commit/5c59de52a31da937663ad2cef055213489b0516e Stats: 1078

Re: RFR: 8300140: ZipFile.isSignatureRelated returns true for files in META-INF subdirectories [v15]

2023-01-27 Thread Eirik Bjorsnos
On Fri, 27 Jan 2023 22:16:18 GMT, Weijun Wang wrote: > Maybe we can rename `ZipFile::isSignatureRelated` to `ZipFile::isBlockOrSF` > as well? The term "signature related" seems to be used quite extensively around ZipFile and also in JavaUtilZipFileAccess. Semantics are very similar, but not

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter [v2]

2023-01-27 Thread Raffaello Giulietti
On Fri, 27 Jan 2023 22:10:38 GMT, Roger Riggs wrote: >> The only changes I made myself in the test files are in >> Basic-X.java.template (including the copyright year). The other files were >> generated by a script, which happens to also change the copyright year for >> otherwise unmodified

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter [v3]

2023-01-27 Thread Raffaello Giulietti
> Align `double` and `float` decimal conversions in `java.util.Formatter` with > the algorithm used in `Double.toString(double)`. Raffaello Giulietti has updated the pull request incrementally with one additional commit since the last revision: 8300869: Make use of the

Re: RFR: JDK-8300808: Accelerate Base64 on x86 for AVX2 [v6]

2023-01-27 Thread Claes Redestad
On Fri, 27 Jan 2023 21:36:29 GMT, Claes Redestad wrote: >> Scott Gibbons has updated the pull request with a new target base due to a >> merge or a rebase. The incremental webrev excludes the unrelated changes >> brought in by the merge/rebase. The pull request contains 13 additional >>

Re: RFR: JDK-8300808: Accelerate Base64 on x86 for AVX2 [v6]

2023-01-27 Thread Claes Redestad
On Fri, 27 Jan 2023 18:31:50 GMT, Scott Gibbons wrote: >> Added code for Base64 acceleration (encode and decode) which will accelerate >> ~4x for AVX2 platforms. >> >> Encode performance: >> **Old:** >> >> Benchmark (maxNumBytes) Mode Cnt Score Error >> Units

Re: RFR: 8300140: ZipFile.isSignatureRelated returns true for files in META-INF subdirectories [v15]

2023-01-27 Thread Weijun Wang
On Tue, 24 Jan 2023 12:31:30 GMT, Eirik Bjorsnos wrote: >> Some call sites of SignatureFileVerifier.isBlockOrSF fails to check that >> files reside in META-INF directly, and not in a subdirectory of META-INF. >> >> The mentioned call sites needs updates to check and ignore such files. >> >> A

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter [v2]

2023-01-27 Thread Roger Riggs
On Fri, 27 Jan 2023 21:27:57 GMT, Raffaello Giulietti wrote: >> test/jdk/java/util/Formatter/BasicInt.java line 1: >> >>> 1: /* >> >> It looks line the non-float/double test classes are unchanged, they could be >> dropped from the PR. > > The only changes I made myself in the test files are

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter [v2]

2023-01-27 Thread Raffaello Giulietti
On Fri, 27 Jan 2023 19:56:28 GMT, Roger Riggs wrote: >> Raffaello Giulietti has updated the pull request incrementally with one >> additional commit since the last revision: >> >> 8300869: Make use of the Double.toString(double) algorithm in >> java.util.Formatter >> >> Added tests for

RFR: Merge jdk20

2023-01-27 Thread Jesper Wilhelmsson
Forwardport JDK 20 -> JDK 21 - Commit messages: - Merge remote-tracking branch 'jdk20/master' into Merge_jdk20 - 8301206: Fix issue with LocaleData after JDK-8300719 - 8300953: ClassDesc::ofInternalName missing @since tag - 8300719: JDK 20 RDP2 L10n resource files update The

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted [v2]

2023-01-27 Thread Glavo
On Fri, 27 Jan 2023 20:58:40 GMT, Rémi Forax wrote: > I think the simplest solution is to have a non public interface declared > inside java.util. Like java.util.RandomAccess, but non public. The main > advantage to use an interface is that you can document it and it's easy to > find all the

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted [v2]

2023-01-27 Thread Rémi Forax
On Fri, 27 Jan 2023 13:53:45 GMT, Glavo wrote: >> I checked the `java.base` module, and all the `Collection#toArray()` method >> of collections be implemented correctly. >> >> Their return values can be trusted, so many unnecessary array duplication >> can be eliminated. > > Glavo has updated

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted [v2]

2023-01-27 Thread Glavo
On Fri, 27 Jan 2023 14:28:08 GMT, Alan Bateman wrote: > I skimmed through the latest update. I see you've considered the possibility > of a Matryoshka doll showing up but the optimization is still very very > scary. I think it would require an audit of every API in java.base that >

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter [v2]

2023-01-27 Thread Roger Riggs
On Fri, 27 Jan 2023 18:19:58 GMT, Raffaello Giulietti wrote: >> Align `double` and `float` decimal conversions in `java.util.Formatter` with >> the algorithm used in `Double.toString(double)`. > > Raffaello Giulietti has updated the pull request incrementally with one > additional commit

Integrated: 8301120: Cleanup utility classes java.util.Arrays and java.util.Collections

2023-01-27 Thread Tagir F . Valeev
On Wed, 25 Jan 2023 21:41:37 GMT, Tagir F. Valeev wrote: > number of minor cleanups could be done in Arrays and Collections utility > classes. > In Arrays: > - Redundant import jdk.internal.misc.Unsafe; > - C-style array declaration is used in public static boolean equals(short[] > a, short

Withdrawn: 8296546: Add @spec tags to API

2023-01-27 Thread duke
On Thu, 10 Nov 2022 01:10:13 GMT, Jonathan Gibbons wrote: > Please review a "somewhat automated" change to insert `@spec` tags into doc > comments, as appropriate, to leverage the recent new javadoc feature to > generate a new page listing the references to all external specifications >

Re: RFR: JDK-8300808: Accelerate Base64 on x86 for AVX2 [v6]

2023-01-27 Thread Scott Gibbons
> Added code for Base64 acceleration (encode and decode) which will accelerate > ~4x for AVX2 platforms. > > Encode performance: > **Old:** > > Benchmark (maxNumBytes) Mode Cnt Score Error > Units > Base64Encode.testBase64Encode 1024 thrpt3

Integrated: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module

2023-01-27 Thread Mandy Chung
On Thu, 26 Jan 2023 21:03:59 GMT, Mandy Chung wrote: > Currently, a `Lookup` object with `PACKAGE` access can be used to inject a > class in the runtime package of the Lookup's lookup class via > `Lookup::defineClass`. The classes that are injected have the same access > as other members in

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v4]

2023-01-27 Thread Paul Sandoz
On Fri, 27 Jan 2023 18:20:42 GMT, Mandy Chung wrote: >> Currently, a `Lookup` object with `PACKAGE` access can be used to inject a >> class in the runtime package of the Lookup's lookup class via >> `Lookup::defineClass`. The classes that are injected have the same access >> as other

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v4]

2023-01-27 Thread Joe Darcy
On Fri, 27 Jan 2023 18:20:42 GMT, Mandy Chung wrote: >> Currently, a `Lookup` object with `PACKAGE` access can be used to inject a >> class in the runtime package of the Lookup's lookup class via >> `Lookup::defineClass`. The classes that are injected have the same access >> as other

Re: RFR: 8301120: Cleanup utility classes java.util.Arrays and java.util.Collections [v2]

2023-01-27 Thread Joe Darcy
On Wed, 25 Jan 2023 22:23:26 GMT, Tagir F. Valeev wrote: >> number of minor cleanups could be done in Arrays and Collections utility >> classes. >> In Arrays: >> - Redundant import jdk.internal.misc.Unsafe; >> - C-style array declaration is used in public static boolean equals(short[] >> a,

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter [v2]

2023-01-27 Thread Raffaello Giulietti
On Fri, 27 Jan 2023 18:19:58 GMT, Raffaello Giulietti wrote: >> Align `double` and `float` decimal conversions in `java.util.Formatter` with >> the algorithm used in `Double.toString(double)`. > > Raffaello Giulietti has updated the pull request incrementally with one > additional commit

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v4]

2023-01-27 Thread Mandy Chung
> Currently, a `Lookup` object with `PACKAGE` access can be used to inject a > class in the runtime package of the Lookup's lookup class via > `Lookup::defineClass`. The classes that are injected have the same access > as other members in the module and can access private members of all types

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter [v2]

2023-01-27 Thread Raffaello Giulietti
> Align `double` and `float` decimal conversions in `java.util.Formatter` with > the algorithm used in `Double.toString(double)`. Raffaello Giulietti has updated the pull request incrementally with one additional commit since the last revision: 8300869: Make use of the

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted [v2]

2023-01-27 Thread Sergey Tsypanov
On Fri, 27 Jan 2023 14:28:08 GMT, Alan Bateman wrote: > It might be better to focus on a few specific cases that can be proven to be > safe As of trusted collections from java.base we have - ArrayList - Arrays.asList() - HashSet - LinkedHashSet - TreeSet - EnumSet - ArrayDeque - COWArrayList -

Integrated: 8177418: NPE is not apparent for methods in java.util.TimeZone API docs

2023-01-27 Thread Justin Lu
On Fri, 6 Jan 2023 22:38:13 GMT, Justin Lu wrote: > When their input is null, the following methods in java.util.TimeZone throw a > NullPointerException: > > _TimeZone.getTimeZone(String ID) > TimeZone.setID(String ID) > TimeZone.inDaylightTime(Date date)_ > > For example, > > > String

Re: RFR: JDK-8301205: Port fdlibm log10 to Java [v2]

2023-01-27 Thread Joe Darcy
On Fri, 27 Jan 2023 13:47:07 GMT, Raffaello Giulietti wrote: >> src/java.base/share/classes/java/lang/FdLibm.java line 820: >> >>> 818: hx = (hx & 0x000f_) | ((0x3ff - i) << 20); >>> 819: y = (double)(k + i); >>> 820: x = __HI(x, hx); >> >> `

Re: RFR: JDK-8301205: Port fdlibm log10 to Java [v2]

2023-01-27 Thread Joe Darcy
> Restarting the port of FDLIBM to Java with the log10 method. > > There are two port, the first a near-transliteration from C port to use as a > test reference in > > test/jdk/java/lang/StrictMath/FdlibmTranslit.java > > and a more idiomatic Java port in > >

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v3]

2023-01-27 Thread Alan Bateman
On Fri, 27 Jan 2023 17:41:43 GMT, Mandy Chung wrote: >> Currently, a `Lookup` object with `PACKAGE` access can be used to inject a >> class in the runtime package of the Lookup's lookup class via >> `Lookup::defineClass`. The classes that are injected have the same access >> as other

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v2]

2023-01-27 Thread Mandy Chung
On Fri, 27 Jan 2023 17:07:08 GMT, Mandy Chung wrote: >> src/java.base/share/classes/java/lang/Module.java line 605: >> >>> 603: * {@link java.lang.invoke.MethodHandles.Lookup Lookup} object >>> that is allowed to >>> 604: * {@link >>>

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v3]

2023-01-27 Thread Mandy Chung
> Currently, a `Lookup` object with `PACKAGE` access can be used to inject a > class in the runtime package of the Lookup's lookup class via > `Lookup::defineClass`. The classes that are injected have the same access > as other members in the module and can access private members of all types

Re: RFR: 8177418: NPE is not apparent for methods in java.util.TimeZone API docs [v8]

2023-01-27 Thread Lance Andersen
On Wed, 25 Jan 2023 20:21:11 GMT, Justin Lu wrote: >> When their input is null, the following methods in java.util.TimeZone throw >> a NullPointerException: >> >> _TimeZone.getTimeZone(String ID) >> TimeZone.setID(String ID) >> TimeZone.inDaylightTime(Date date)_ >> >> For example, >> >>

[jdk20] Integrated: 8301206: Fix issue with LocaleData after JDK-8300719

2023-01-27 Thread Damon Nguyen
On Fri, 27 Jan 2023 01:43:11 GMT, Damon Nguyen wrote: > Localization update didn't include an update to LocaleData file. This PR > addresses this by updating the file with the newly translated values. The > LocaleDataTest now passes. This should address the recent related failures to >

Re: [Proposal] Make toLowerCase and toUpperCase based on Locale.ROOT by default

2023-01-27 Thread Naoto Sato
+1 Unfortunately, it would be too disruptive to change the decades old behavior. Naoto On 1/27/23 3:53 AM, Alan Bateman wrote: On 27/01/2023 05:42, Glavo wrote: I analyzed the usage of toLowerCase and toUpperCase in OpenJDK more carefully,  and found that none of the use cases really

Integrated: 8300924: Method::invoke throws wrong exception type when passing wrong number of arguments to method with 4 or more parameters

2023-01-27 Thread Mandy Chung
On Tue, 24 Jan 2023 18:19:22 GMT, Mandy Chung wrote: > A simple fix in core reflection to check if the number of actual and formal > parameters differ before invoking the method or the constructor regardless of > whether it's a specialized case or not. This pull request has now been

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v2]

2023-01-27 Thread Mandy Chung
On Fri, 27 Jan 2023 11:44:46 GMT, Alan Bateman wrote: > I wonder if this should be an apiNote rather method description. I considered this and no clear cut on this. I don't have a strong opinion on this. What do you think? - PR: https://git.openjdk.org/jdk/pull/12236

Re: RFR: 8301120: Cleanup utility classes java.util.Arrays and java.util.Collections [v2]

2023-01-27 Thread Stuart Marks
On Wed, 25 Jan 2023 22:23:26 GMT, Tagir F. Valeev wrote: >> number of minor cleanups could be done in Arrays and Collections utility >> classes. >> In Arrays: >> - Redundant import jdk.internal.misc.Unsafe; >> - C-style array declaration is used in public static boolean equals(short[] >> a,

Re: RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter

2023-01-27 Thread Raffaello Giulietti
On Fri, 27 Jan 2023 16:02:38 GMT, Raffaello Giulietti wrote: > Align `double` and `float` decimal conversions in `java.util.Formatter` with > the algorithm used in `Double.toString(double)`. The specification in `Formatter` explicitly refers to the outcome of `Double.toString(double)`.

RFR: 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter

2023-01-27 Thread Raffaello Giulietti
Align `double` and `float` decimal conversions in `java.util.Formatter` with the algorithm used in `Double.toString(double)`. - Commit messages: - 8300869: Make use of the Double.toString(double) algorithm in java.util.Formatter Changes:

[jdk20] Integrated: 8300953: ClassDesc::ofInternalName missing @since tag

2023-01-27 Thread Adam Sotona
On Tue, 24 Jan 2023 13:35:14 GMT, Adam Sotona wrote: > ClassDesc::ofInternalName was added in JDK 20, however @since tag is missing. > This patch fixes the javadoc. > > Please review. > > Thanks, > Adam This pull request has now been integrated. Changeset: b22e5216 Author:Adam Sotona

Re: [jdk20] RFR: 8300953: ClassDesc::ofInternalName missing @since tag

2023-01-27 Thread Jonathan Gibbons
On Tue, 24 Jan 2023 13:35:14 GMT, Adam Sotona wrote: > ClassDesc::ofInternalName was added in JDK 20, however @since tag is missing. > This patch fixes the javadoc. > > Please review. > > Thanks, > Adam Marked as reviewed by jjg (Reviewer). - PR:

Re: RFR: 8294982: Implementation of Classfile API [v11]

2023-01-27 Thread Adam Sotona
> This is root pull request with Classfile API implementation, tests and > benchmarks initial drop into JDK. > > Following pull requests consolidating JDK class files parsing, generating, > and transforming ([JDK-8294957](https://bugs.openjdk.org/browse/JDK-8294957)) > will chain to this one.

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted [v2]

2023-01-27 Thread Alan Bateman
On Fri, 27 Jan 2023 13:53:45 GMT, Glavo wrote: >> I checked the `java.base` module, and all the `Collection#toArray()` method >> of collections be implemented correctly. >> >> Their return values can be trusted, so many unnecessary array duplication >> can be eliminated. > > Glavo has updated

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted [v2]

2023-01-27 Thread Glavo
> I checked the `java.base` module, and all the `Collection#toArray()` method > of collections be implemented correctly. > > Their return values can be trusted, so many unnecessary array duplication can > be eliminated. Glavo has updated the pull request incrementally with one additional

Re: RFR: JDK-8301205: Port fdlibm log10 to Java

2023-01-27 Thread Raffaello Giulietti
On Fri, 27 Jan 2023 06:52:31 GMT, Joe Darcy wrote: > Restarting the port of FDLIBM to Java with the log10 method. > > There are two port, the first a near-transliteration from C port to use as a > test reference in > > test/jdk/java/lang/StrictMath/FdlibmTranslit.java > > and a more

Re: RFR: JDK-8301205: Port fdlibm log10 to Java

2023-01-27 Thread Raffaello Giulietti
On Fri, 27 Jan 2023 13:45:18 GMT, Raffaello Giulietti wrote: >> Restarting the port of FDLIBM to Java with the log10 method. >> >> There are two port, the first a near-transliteration from C port to use as a >> test reference in >> >> test/jdk/java/lang/StrictMath/FdlibmTranslit.java >> >>

Re: RFR: 8294982: Implementation of Classfile API [v10]

2023-01-27 Thread Adam Sotona
> This is root pull request with Classfile API implementation, tests and > benchmarks initial drop into JDK. > > Following pull requests consolidating JDK class files parsing, generating, > and transforming ([JDK-8294957](https://bugs.openjdk.org/browse/JDK-8294957)) > will chain to this one.

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Tingjun Yuan
On Fri, 27 Jan 2023 12:15:34 GMT, Glavo wrote: > > What about Collections.synchronizedCollection and other methods that may > > wrap/delagete to collections from other modules? > > Good question, I missed this point. I think I should provide a helper method > to check whether the collection

Re: [jdk20] RFR: 8301206: Fix issue with LocaleData after JDK-8300719 [v2]

2023-01-27 Thread Naoto Sato
On Fri, 27 Jan 2023 02:34:37 GMT, Damon Nguyen wrote: >> Localization update didn't include an update to LocaleData file. This PR >> addresses this by updating the file with the newly translated values. The >> LocaleDataTest now passes. This should address the recent related failures >> to

Re: Is ReDos seen as bug/vulnerability?

2023-01-27 Thread Alan Bateman
On 27/01/2023 11:50, David Schumann wrote: Hello, during a PenTest we found a ReDos issue in the JRE which causes Matcher.matches() to go into an endless loop. Is such an issue considered a bug for the JDK team (aka should I file a bug report)? Or is such an issue considered "by design"?

Re: Is ReDos seen as bug/vulnerability?

2023-01-27 Thread Raffaello Giulietti
Please file a bug report with the relevant (and disclosable) details. From: core-libs-dev on behalf of David Schumann Date: Friday, 27 January 2023 at 12:50 To: core-libs-dev@openjdk.org Subject: Is ReDos seen as bug/vulnerability? Hello, during a PenTest we found a ReDos issue in the JRE

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Glavo
On Fri, 27 Jan 2023 11:35:54 GMT, Alan Bateman wrote: > What about Collections.synchronizedCollection and other methods that may > wrap/delagete to collections from other modules? Good question, I missed this point. I think I should provide a helper method to check whether the collection is

Re: [Proposal] Make toLowerCase and toUpperCase based on Locale.ROOT by default

2023-01-27 Thread Alan Bateman
On 27/01/2023 05:42, Glavo wrote: I analyzed the usage of toLowerCase and toUpperCase in OpenJDK more carefully,  and found that none of the use cases really expected locale-sensitive behavior I expected that as there were a number of passes over these use-sites over the years. That said, if

Is ReDos seen as bug/vulnerability?

2023-01-27 Thread David Schumann
Hello, during a PenTest we found a ReDos issue in the JRE which causes Matcher.matches() to go into an endless loop. Is such an issue considered a bug for the JDK team (aka should I file a bug report)? Or is such an issue considered "by design"? The issue appears in current JRE versions (tested

Re: RFR: 8217920: Lookup.defineClass injects a class that can access private members of any class in its own module [v2]

2023-01-27 Thread Alan Bateman
On Thu, 26 Jan 2023 22:27:36 GMT, Mandy Chung wrote: >> Currently, a `Lookup` object with `PACKAGE` access can be used to inject a >> class in the runtime package of the Lookup's lookup class via >> `Lookup::defineClass`. The classes that are injected have the same access >> as other

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Alan Bateman
On Thu, 26 Jan 2023 06:46:16 GMT, Glavo wrote: > I checked the `java.base` module, and all the `Collection#toArray()` method > of collections be implemented correctly. > > Their return values can be trusted, so many unnecessary array duplication can > be eliminated. What about

Re: Math.clamp method?

2023-01-27 Thread Tagir Valeev
Hello, Remi! > Given that the semantics of NaN is clearly defined for Math.max/min (if one > of the values is NaN the result is NaN), > I don't believe we need a special case here for NaN. > > The semantics should be, this is equivalent to execute > Math.max(min, Math.min(max, value)) > > So

Re: Math.clamp method?

2023-01-27 Thread Tagir Valeev
Hello, all! Thank you for an interesting discussion. As I see some interest towards this feature, I've created a new issue to track this: https://bugs.openjdk.org/browse/JDK-8301226 I haven't found an exact duplicate, only an issue with related discussion JDK-4466549. Feel free to link duplicates

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le [v2]

2023-01-27 Thread Richard Reingruber
On Fri, 27 Jan 2023 10:16:56 GMT, Matthias Baesken wrote: >> test/jdk/jdk/internal/vm/Continuation/Fuzz.java line 95: >> >>> 93: } >>> 94: if (Platform.isPPC()) { >>> 95: COMPILATION_TIMEOUT = COMPILATION_TIMEOUT * 2; >> >> I guess this won't compile.

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le [v3]

2023-01-27 Thread Richard Reingruber
On Fri, 27 Jan 2023 10:20:26 GMT, Matthias Baesken wrote: >> On our Linux ppc64le test machines we quite often see compilation timeouts >> in the test jdk/internal/vm/Continuation/Fuzz.java. >> (especially when running with fastdebug binaries) >> So it probably makes sense to use a higher

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le [v2]

2023-01-27 Thread Matthias Baesken
On Fri, 27 Jan 2023 10:07:31 GMT, Richard Reingruber wrote: >> Matthias Baesken has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Do not limit to Linux, handle all PPC platforms > > test/jdk/jdk/internal/vm/Continuation/Fuzz.java line 95:

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le [v3]

2023-01-27 Thread Matthias Baesken
> On our Linux ppc64le test machines we quite often see compilation timeouts in > the test jdk/internal/vm/Continuation/Fuzz.java. > (especially when running with fastdebug binaries) > So it probably makes sense to use a higher compilation timeout (maybe factor > 2) on this platform. Matthias

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le [v2]

2023-01-27 Thread Richard Reingruber
On Fri, 27 Jan 2023 08:52:21 GMT, Matthias Baesken wrote: >> On our Linux ppc64le test machines we quite often see compilation timeouts >> in the test jdk/internal/vm/Continuation/Fuzz.java. >> (especially when running with fastdebug binaries) >> So it probably makes sense to use a higher

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Glavo
On Thu, 26 Jan 2023 10:05:28 GMT, Sergey Tsypanov wrote: > > it is necessary to copy the elements to a larger new array > > Right, I missed this is addAll() method. Btw, in this class you could do > similar optimization in constructor as well. Just now, I have pushed some updates and used

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Sergey Tsypanov
On Thu, 26 Jan 2023 10:01:21 GMT, Glavo wrote: > it is necessary to copy the elements to a larger new array Right, I missed this is addAll() method. Btw, in this class you could do similar optimization in constructor as well. - PR: https://git.openjdk.org/jdk/pull/12212

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Glavo
On Fri, 27 Jan 2023 09:35:00 GMT, Sergey Tsypanov wrote: > @Glavo I've filed https://bugs.openjdk.org/browse/JDK-8301220 so you can use > it for this PR. Thank you! > I think as soon as we anyway assign the array from trusted collection, we > don't need `len == 0` check here any more I

Re: RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Sergey Tsypanov
On Thu, 26 Jan 2023 06:46:16 GMT, Glavo wrote: > I checked the `java.base` module, and all the `Collection#toArray()` method > of collections be implemented correctly. > > Their return values can be trusted, so many unnecessary array duplication can > be eliminated. You could also have a

RFR: 8301220: Return value of toArray() of Сollection types from java.base should be trusted

2023-01-27 Thread Glavo
I checked the `java.base` module, and all the `Collection#toArray()` method of collections be implemented correctly. Their return values can be trusted, so many unnecessary array duplication can be eliminated. - Commit messages: - fix checkstyle - Update ImmutableCollections -

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le [v2]

2023-01-27 Thread Matthias Baesken
On Fri, 27 Jan 2023 08:41:12 GMT, Richard Reingruber wrote: >> Matthias Baesken has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Do not limit to Linux, handle all PPC platforms > > test/jdk/jdk/internal/vm/Continuation/Fuzz.java line 94:

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le [v2]

2023-01-27 Thread Matthias Baesken
> On our Linux ppc64le test machines we quite often see compilation timeouts in > the test jdk/internal/vm/Continuation/Fuzz.java. > (especially when running with fastdebug binaries) > So it probably makes sense to use a higher compilation timeout (maybe factor > 2) on this platform. Matthias

Re: RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le

2023-01-27 Thread Richard Reingruber
On Fri, 27 Jan 2023 08:33:32 GMT, Matthias Baesken wrote: > On our Linux ppc64le test machines we quite often see compilation timeouts in > the test jdk/internal/vm/Continuation/Fuzz.java. > (especially when running with fastdebug binaries) > So it probably makes sense to use a higher

RFR: JDK-8301163: jdk/internal/vm/Continuation/Fuzz.java increase COMPILATION_TIMEOUT for Linux ppc64le

2023-01-27 Thread Matthias Baesken
On our Linux ppc64le test machines we quite often see compilation timeouts in the test jdk/internal/vm/Continuation/Fuzz.java. (especially when running with fastdebug binaries) So it probably makes sense to use a higher compilation timeout (maybe factor 2) on this platform. -

ConcurrentModificationException has links to Vector, Hashtable, LinkedList

2023-01-27 Thread Andrey Turbanov
Hello. I've noticed that ConcurrentModificationException javadoc has a "See Also" section which contains links to legacy collections: Vector, Hashtable, LinkedList. https://docs.oracle.com/en/java/javase/19/docs/api/java.base/java/util/ConcurrentModificationException.html I wonder if it makes