On Wed, 27 May 2026 14:38:44 GMT, Chen Liang <[email protected]> wrote:
>> ReflectionFactory.newConstructorForSerializatoin might bypass strict >> initialization. We should make sure the skipped classes in the constructor >> chain do not declare strict instance fields. >> >> This updates the specification of jdk.unsupported's ReflectionFactory to >> reflect this behavioral update. >> >> --------- >> - [x] I confirm that I make this contribution in accordance with the >> [OpenJDK Interim AI Policy](https://openjdk.org/legal/ai). > > Chen Liang has updated the pull request with a new target base due to a merge > or a rebase. The incremental webrev excludes the unrelated changes brought in > by the merge/rebase. The pull request contains five additional commits since > the last revision: > > - Review comments > - Merge branch 'lworld' of https://github.com/openjdk/valhalla into > fix/reflect-factory-strict > - Further cleanup > - Merge branch 'lworld' of https://github.com/openjdk/valhalla into > fix/reflect-factory-strict > - Prevent reflection factory hacking strict init src/jdk.unsupported/share/classes/sun/reflect/ReflectionFactory.java line 73: > 71: * @throws UnsupportedOperationException if the constructor to call is > 72: * not suitable for the class to instantiate, such as if the > 73: * constructor is not of the given class or one of its > supertype, Suggestion: * constructor is not of the given class or one of its supertypes, src/jdk.unsupported/share/classes/sun/reflect/ReflectionFactory.java line 87: > 85: * Returns an accessible no-arg constructor for a class. > 86: * The no-arg constructor is found searching the class and its > supertypes. > 87: * The no-arg constructor would ensure all strictly-initialized fields Suggestion: * The no-arg constructor is found searching the class and its supertypes, * and must ensure that all strictly-initialized fields src/jdk.unsupported/share/classes/sun/reflect/ReflectionFactory.java line 91: > 89: * > 90: * @param cl the class to instantiate > 91: * @return a no-arg constructor for the class or {@code null} if the Suggestion: * @return a no-arg constructor for the class, or {@code null} if the ------------- PR Review Comment: https://git.openjdk.org/valhalla/pull/2350#discussion_r3362943463 PR Review Comment: https://git.openjdk.org/valhalla/pull/2350#discussion_r3362951894 PR Review Comment: https://git.openjdk.org/valhalla/pull/2350#discussion_r3362957076
