On Wed, 12 Aug 2026 17:43:55 GMT, Coleen Phillimore <[email protected]> wrote:
>> @AlanBateman we can assert that the classloader is one of the built-in >> loaders, so the behavior should be well defined. >> >> I agree that we should call `ClassLoader.findResource()` and check that if >> the returned URL matches the zip file's name. >> >> It's probably easier to write most of the code in CDS.java. The native code >> can pass the file name of the zip file as a URL (this can be done with >> `CDSProtectionDomain::to_file_URL()`). The Java code can compare this URL >> with the value returned by `ClassLoader.findResource()`. > > I don't see that check that it's a built-in loaders (or assert) here. I think I understand Alan's question. His question is any class loader might do something like skip normal delegation and call MyFooOtherClassLoader.getResource(), so you need to know that it's a normal delegating class loader. So builtin_class_loaders - like the AppClassLoader (ie the normal system loader) will have a normal delegation and not bypass it to find something strange. Did I get this right? Maybe don't need an assert like assert(SystemDictionaryShared::is_builtin_loader(loader_data) because this case always comes through. Maybe a comment would suffice. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/32087#discussion_r3769327669
