On 27/03/2019 23:17, Mandy Chung wrote:
:
The proposed fix is to perform proper access check. When there is no
caller frame, it only allows to access to public members of a public type
in an unconditional exported API package.
The approach seems reasonable to me and we should, at some point, try to
align the other @CS methods with this behavior. As Mandy knows, this is
unspecified behavior and we aren't consistent in the JDK on how to
handle "no caller frame" case. Some @CS methods will throw NPE if
invoked directly, others detect the caller is null and throw or treat it
as Object.class.
In the patch, shouldn't slowVerifyAccess check that memberClass is public?
-Alan
