[8] RFR of 8066985: Java Webstart downloading packed files can result in Timezone set to UTC

[Peter Levart]

On 03/19/2015 02:53 PM, Kumar Srinivasan wrote:
> Mikhail,
>
> You can move the common utilitieschangeDefaultTimeZoneToUtc and
> restoreDefaultTimeZoneto Utils.java.
>
> Also I am not sure how effective the test is ?  does it catch the issue ?
> if you don't have the fix in PackerImpl and UnpackerImpl ?
>
> Otherwise it looks good, and I can sponsor this patch for you.
>
> Kumar

Hi Mikhail,

Is this code part of some utility so that it is executed exclusively in 
it's own JVM, or can it also be executed by some public API or internal 
JVM thread? It appears to be the later (used by java.util.jar.Pack200 
public API), but haven't checked.

In case of the later, I think it is very strange that the code changes 
global JVM timezone, albeit just temporarily. This could affect other 
code that needs default TZ and executes concurrently.

Even in case of the former, if the PackerImpl.pack can be executed by 
multiple concurrent threads and if UnpackerImpl.unpack can be executed 
by multiple concurrent threads, what guarantees that some 
PackerImpl.pack thread is not executed concurrently with some 
UnpackerImpl.unpack thread? You only track each method separately.


Regards, Peter

>
>
> On 3/18/2015 3:07 PM, Kumar Srinivasan wrote:
>>
>> Hello Mikhail,
>>
>>> Hi all,
>>>
>>> Bug: https://bugs.openjdk.java.net/browse/JDK-8066985
>>>
>>> The problem is that packer/unpacker changes global state( default 
>>> time zone ) without proper synchronization:
>>> http://hg.openjdk.java.net/jdk9/client/jdk/file/a159e5358e25/src/java.base/share/classes/com/sun/java/util/jar/pack/PackerImpl.java#l85 
>>>
>>>
>>> however javadoc says that it's save to use it in concurrent way if 
>>> each thread has it's own packer/unpacker instance:
>>> http://hg.openjdk.java.net/jdk9/client/jdk/file/a159e5358e25/src/java.base/share/classes/java/util/jar/Pack200.java#l149 
>>>
>>>
>>> The fix is:
>>> 1. first packer/unpacker saves default time zone
>>> 2. the last set it back.
>>>
>>> Webrev:
>>> http://cr.openjdk.java.net/~mcherkas/8066985/webrev.00/
>>
>> The above link is wrong!, it takes me to webrev for 8073187,
>> which has only the PackerImpl changes.
>>
>> I am guessing the link should be:
>> http://cr.openjdk.java.net/~mcherkas/8066985/webrev.00/
>>
>> Kumar
>>
>>>
>>> Thanks,
>>> Mikhail.
>>>
>>>
>>>
>>>
>>>
>>
>