Paul King created GROOVY-12282:
----------------------------------
Summary: Document ClassValue usage rules for Groovy developers and
record the class-loader-pinning audit
Key: GROOVY-12282
URL: https://issues.apache.org/jira/browse/GROOVY-12282
Project: Groovy
Issue Type: Improvement
Reporter: Paul King
The integration guide (GROOVY-12142) covers what _users_ need; this ticket
captures the developer-facing rules so the analysis from the [PR
#2798|https://github.com/apache/groovy/pull/2798] review is not lost. Content
to write up (developer docs — location to team taste, e.g. a design note or
{{package-info}} in {{org.codehaus.groovy.reflection}}):
# The chain model: _key class → association → value → everything reachable_;
associations live as long as the key class, by design
([JDK-8136353|https://bugs.openjdk.org/browse/JDK-8136353]).
# The key-origin rule: Groovy-loaded key = fine; JDK/platform key = dangerous
whenever anything Groovy-loaded is reachable from the value — including through
indirection (collections of Groovy-typed elements).
# The {{SoftReference}} strategy and its preconditions: recomputation must be
legal and affordable; access becomes check → if cleared, remove the association
→ recompute.
# Audit record (as of PR #2798):
#* {{ClassInfo.globalClassValue}} — problem, tracked by the companion
investigation ticket;
#* {{AwaitableAdapterRegistry.awaitableCache}} — problem, tracked by the
companion fix ticket;
#* {{Closure.CALL_OVERRIDES}} — safe (keys are {{Closure}} subclasses, which
die with their defining loader);
#* {{org.apache.groovy.metaclass.Realm.cv}} — currently unreachable code, but
must adopt these rules if ever activated, or be removed.
# Forward rule: new {{ClassValue}} uses go through {{GroovyClassValueFactory}}
(or document why not), and state their key-origin analysis in review.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
