<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 3/10/25 4:14 PM, Alan Bateman wrote:<br>
</div>
<blockquote type="cite" cite="mid:e063c13f-c830-4665-ab3c-9bfad3728a8f@oracle.com">
On 10/03/2025 18:25, Ryan Ernst wrote:<br>
<blockquote type="cite" cite="mid:12AA447F-DFEC-4863-8E16-8D0265EC3CAE@iernst.net"> I
created a reproduction:
<div><br>
</div>
<div>
<div style="display: block;">
<div style="-webkit-user-select: all; -webkit-user-drag: element; display: inline-block;" class="apple-rich-link" draggable="true" role="link" data-url="https://github.com/rjernst/verify-error-repro"><a style="border-radius:10px;font-family:-apple-system, Helvetica, Arial, sans-serif;display:block;-webkit-user-select:none;width:300px;user-select:none;-webkit-user-modify:read-only;user-modify:read-only;overflow:hidden;text-decoration:none;" class="lp-rich-link" rel="nofollow" href="https://urldefense.com/v3/__https://github.com/rjernst/verify-error-repro__;!!ACWV5N9M2RV99hQ!KIEIqqu475SaI3subOAn49baG1td4FYwqRarkv_3BgCYLhaTpVFwf-MKTovjGLmIr4KUnbhvWgfw4Q$" dir="ltr" role="button" draggable="false" width="300" moz-do-not-send="true">
<table style="table-layout:fixed;border-collapse:collapse;width:300px;background-color:#E6E6E6;font-family:-apple-system, Helvetica, Arial, sans-serif;" class="lp-rich-link-emailBaseTable" width="300" cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<td vertical-align="center" align="center"><img style="width:300px;filter:brightness(0.97);height:150px;" draggable="false" class="lp-rich-link-mediaImage" alt="verify-error-repro.png" src="cid:part1.bIKwBlBl.QoNH0X5a@oracle.com" width="300" height="150"></td>
</tr>
<tr>
<td vertical-align="center">
<table style="table-layout:fixed;font-family:-apple-system, Helvetica, Arial, sans-serif;background-color:rgba(230, 230, 230, 1);-apple-color-filter:initial;" class="lp-rich-link-captionBar" width="300" cellspacing="0" cellpadding="0" bgcolor="#E6E6E6">
<tbody>
<tr>
<td style="padding:8px 0px 8px 0px;" class="lp-rich-link-captionBar-textStackItem">
<div style="max-width:100%;margin:0px 16px 0px 16px;overflow:hidden;" class="lp-rich-link-captionBar-textStack">
<div style="word-wrap:break-word;font-weight:500;font-size:12px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-topCaption-leading"><a rel="nofollow" href="https://urldefense.com/v3/__https://github.com/rjernst/verify-error-repro__;!!ACWV5N9M2RV99hQ!KIEIqqu475SaI3subOAn49baG1td4FYwqRarkv_3BgCYLhaTpVFwf-MKTovjGLmIr4KUnbhvWgfw4Q$" style="text-decoration: none" draggable="false" moz-do-not-send="true"><font style="color: rgba(0, 0, 0, 0.847059);" color="#272727">rjernst/verify-error-repro</font></a></div>
<div style="word-wrap:break-word;font-weight:400;font-size:11px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-bottomCaption-leading"><a rel="nofollow" href="https://urldefense.com/v3/__https://github.com/rjernst/verify-error-repro__;!!ACWV5N9M2RV99hQ!KIEIqqu475SaI3subOAn49baG1td4FYwqRarkv_3BgCYLhaTpVFwf-MKTovjGLmIr4KUnbhvWgfw4Q$" style="text-decoration: none" draggable="false" moz-do-not-send="true"><font style="color: rgba(0, 0, 0, 0.498039);" color="#808080">github.com</font></a></div>
</div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</a></div>
</div>
<div style="display: block;"><br>
</div>
<div style="display: block;">Again, the VerifyError is
correct, it’s what we expect (we created bad bytecode in a
transform), but it doesn’t always occur.</div>
<br>
</div>
</blockquote>
Classes loaded from modules mapped to the boot loader, or classes
on the boot loader's class path, are not verified if modified at
class load time. They are verified if redefined at runtime.
Developers of agents are not infallible so there may be an
argument to enable BytecodeVerificationLocal when an agent enables
one of the can_generate_XXX_class_hook_events capabilities.<br>
</blockquote>
<br>
Yes, I just checked the code and we don't verify classes loaded via
CFLH and we should fix that.<br>
Coleen<br>
<br>
<blockquote type="cite" cite="mid:e063c13f-c830-4665-ab3c-9bfad3728a8f@oracle.com"> <br>
-Alan<br>
</blockquote>
<br>
</body>
</html>