Integrated: 8344011: Remove usage of security manager from Class and reflective APIs

[Alan Bateman]

On 21/02/2025 01:08, James Perkins wrote:
> Please forgive me if this is the wrong medium to report this.
>
> I've found an issue with the change in the ServiceLoader. 
> Specifically, the getConstructor()[1] method. Previously, the method 
> caught Throwable and then fail which would throw a 
> java.util.ServiceConfigurationError exception. With the changes, only 
> a catches a NoSuchMethodException and throws a 
> ServiceConfigurationError then. Is this change in behavior expected?
>
> For some background on how I found this. I had a legitimate classpath 
> issue missing a CDI dependency. However, the constructor was throwing 
> a NoClassDefFoundException because of the missing required class. In 
> versions less than Java 24 this was okay because Throwable was caught. 
> In Java 24 and 25 early access, this is an issue because the 
> NoClassDefFoundException is thrown instead of it being wrapped in a 
> ServiceConfigurationError.
>
Thanks for the bug report. Yes, this is a change in behavior that was 
not intended, and a reminder that there aren't enough tests for NCDFE 
and other linkage errors. Note that there are other cases, that date 
back to JDK 6, where linkage errors aren't wrapped so is other work to 
do in this area. I've created JDK-8350481 to track the behavior change.

-Alan

[1] https://bugs.openjdk.org/browse/JDK-8350481