Re: RFR - 8065552: setAccessible(true) on fields of Class may throw a SecurityException

[Daniel Fuchs]

Hi Seán,

On 01/12/14 18:48, Seán Coffey wrote:

Looks fine to me Daniel. Thanks for handling it. I can work on the 7u
backport if necessary.

Thanks :-)

on the test side would it be worth testing all public classes available
(e.g in rt.jar ?) to ensure that
Field.setAccessible works as expected and that we don't hit this issue
again ? It might be some
what of a heavy test for jtreg inclusion though.

It could be worth a try. But let's wait until JEP 220 is in.

best regards,

-- daniel

regards,
Sean.

On 01/12/14 16:29, Daniel Fuchs wrote:

Hi,

Please find below a patch for:

8065552: setAccessible(true) on fields of Class may throw
         a SecurityException

webrev:
http://cr.openjdk.java.net/~dfuchs/webrev_8065552/webrev.00/

Description of the problem:

The following test case passes on 8u20 but fails on 8u40 and above:

 public class Test {
     public static void main(String[] args) throws Throwable {
         for (Field f : Class.class.getDeclaredFields()) {
             f.setAccessible(true);
         }
     }
 }

The fix for JDK-6642881 introduced a new private field to Class, named
"classloader", whose accessibility can never be modified (from the
default of non-accessible to accessible).

This issue manifests itself in Jython where, when the
Options.respectJavaAccessibility is false (by default it is true), a
SecurityException occurs when it tries to setAccessible(true) all
declared fields on Class:


https://hg.python.org/jython/file/tip/src/org/python/core/PyJavaType.java#l405


The SecurityException is lost in the noise of other exceptions as the
error propagates through the runtime. The observable symptom is
a NullPointerException which occurs when one tries to load the
Jython engine. With 8u40 it fails with exception:

java.lang.NullPointerException
at org.python.core.Py.recursiveIsInstance(Py.java:1861)
at org.python.core.Py.isInstance(Py.java:1828)
at org.python.core.__builtin__.isinstance(__builtin__.java:725)
at org.python.core.Py.displayException(Py.java:1009)
at org.python.core.PyException.printStackTrace(PyException.java:79)
at org.python.core.PyException.toString(PyException.java:98)
at org.apache.commons.logging.impl.SimpleLog.log(SimpleLog.java:329)
at org.apache.commons.logging.impl.SimpleLog.error(SimpleLog.java:525)
at org.apache.bsf.BSFManager.loadScriptingEngine(BSFManager.java:717)
...

The fix is to hide the field from reflection instead of simply
preventing it to be set as accessible.

best regards,

-- daniel