RFR: 8352001: AOT cache should not contain classes injected into built-in class loaders [v3]

[Calvin Cheung]

On Wed, 16 Apr 2025 00:51:23 GMT, Ioi Lam <iklam at openjdk.org> wrote:

>> During an application's training run, it's possible to inject classes into the built-in platform/app class loaders with reflection calls. 
>> 
>> - Before [JDK-8348426](https://bugs.openjdk.org/browse/JDK-8348426), only the names of these classes were recorded in the AOT config file. When the AOT cache is generated, these classes are automatically filtered out.
>> - Since [JDK-8348426](https://bugs.openjdk.org/browse/JDK-8348426), these classes are stored as parsed InstanceKlasses in the AOT config file, and will be transferred into the AOT cache. This new behavior may cause some applications to fail, as they may inject bytecodes that have environment dependencies.
>> 
>> For safety, this PR filters out such injected classes from the AOT config file.
>
> Ioi Lam has updated the pull request with a new target base due to a merge or a rebase. The incremental webrev excludes the unrelated changes brought in by the merge/rebase. The pull request contains five additional commits since the last revision:
> 
>  - Merge branch 'master' into 8352001-exclude-injected-classes-from-builtin-loaders
>  - @calvinccheung review
>  - @matias9927 comment
>  - Merge branch 'master' into 8352001-exclude-injected-classes-from-builtin-loaders
>  - 8352001: AOT cache should not contain classes injected into built-in class loaders

Thanks for the update. Just one minor comment.

src/hotspot/share/cds/aotArtifactFinder.cpp line 26:

> 24: 
> 25: #include "cds/aotClassLinker.hpp"
> 26: #include "cds/aotClassLocation.hpp"

Is this include needed?

-------------

Marked as reviewed by ccheung (Reviewer).

PR Review: https://git.openjdk.org/jdk/pull/24046#pullrequestreview-2773195909
PR Review Comment: https://git.openjdk.org/jdk/pull/24046#discussion_r2047335910