agamal026 opened a new pull request, #540: URL: https://github.com/apache/commons-bcel/pull/540
## Problem `BootstrapMethod` retains arrays supplied to its constructor/setter and exposes the stored array through its getter. A caller can therefore change the object's bootstrap arguments, including the bytes written by `dump()`, without an explicit update. Related to [BCEL-238](https://issues.apache.org/jira/browse/BCEL-238). This PR addresses `BootstrapMethod` argument arrays within the broader issue. ## Changes - Copy the null-normalized setter input and return a copy from the getter. The array-taking constructor uses the existing setter delegation. - Document array ownership and the explicit getter/edit/setter update path. Preserve null-to-empty behavior, public signatures, and both existing copy implementations. - Add behavioral regressions for constructor/setter/getter aliases, serialized output, null handling, and read/dump round trips. Update the copy tests to apply and verify real setter updates, so they remain meaningful with a copying getter. Callers that previously updated arguments by modifying a supplied array or a getter result must now apply those changes with `setBootstrapArguments(...)`. ## Validation and proof Source: [`4ec24e4`](https://github.com/agamal026/commons-bcel/commit/4ec24e4626250c4411388323a05c95d50673e218), tree `f2d597d840a5b09af42518f21ceeaad8ebdfbf98`, based on `0d7c17fb365e4be8e3b66018548e7ebbda0e9507`. Executed on 22 October 2026 with Maven 3.9.11 and OpenJDK 17.0.20 on Linux, targeting Java 8: | Run | Reported | Passed | Failures | Errors | Skipped | | --- | ---: | ---: | ---: | ---: | ---: | | Unchanged production with the same regression tests | 9 | 5 | 4 | 0 | 0 | | Fixed focused tests | 9 | 9 | 0 | 0 | 0 | | Complete default Maven build | 3,090 | 3,075 | 0 | 0 | 15 | The four baseline failures are the constructor, setter, getter, and serialized-output ownership assertions. Both test files are byte-identical between the baseline and fixed runs. The successful default run completed at 11:56:51 UTC, including coverage, RAT, Japicmp, Checkstyle, PMD, SpotBugs, and Javadoc checks. Portable reproduction: ```sh mvn '-Dtest=BootstrapMethod*' clean test mvn ``` [Immutable proof packet with logs, commands, case outcomes, and checksums](https://github.com/agamal026/commons-bcel/blob/e180e3d66257317ed082e486ac8d3b99178e79ce/contribution-review/BCEL-238/README.md). The proof records exact commands, UTC times, source identities, sanitized logs, case counts, and the initial environment failures. This environment needed launchers for the installed JDK's `javap`, `javac`, and Javadoc modules. No project test or check was skipped to work around those missing launchers. Local Linux/JDK 17 results do not establish coverage of other operating systems/JDKs or hosted CI execution. ## AI disclosure ChatGPT generated the implementation, tests, documentation, and this description, and coordinated automated review and test execution. Independent AI reviewers checked scope and compatibility; no independent human review is claimed. The commit includes a `Generated-by: ChatGPT` trailer. The contribution guidelines and ASF Generative Tooling Guidance were reviewed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
