[jdk21u-dev] RFR: 8334870: javac does not accept classfiles with certain permitted RuntimeVisibleParameterAnnotations and RuntimeInvisibleParameterAnnotations attributes

Tue Aug 5 20:22:13 UTC 2025

On Fri, 27 Jun 2025 01:16:59 GMT, Liam Miller-Cushon <cushon at openjdk.org> wrote:

> This change allows javac to tolerate `RuntimeVisibleParameterAnnotations` and `RuntimeInvisibleParameterAnnotations` that do not contain entries for all parameters, or that contain additional entries.
> 
> Currently class reading crashes with an `ArrayIndexOutOfBoundsException` if the attributes contain fewer than the expected number of parameters, which leaves method symbols in an invalid state and causes the crash discussed in [JDK-8359336](https://bugs.openjdk.org/browse/JDK-8359336).

That is a good question, and I'm not sure how to evaluate the risk/benefit.

There is some impact from the bug, there was some related discussion on compiler-dev with some input from owners of affected tools ([linked here](https://bugs.openjdk.org/browse/JDK-8341779?focusedId=14728458&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-14728458)). I think this is also a concern for Spring which has been trying to adopt more type annotations ([see here](https://spring.io/blog/2025/03/10/null-safety-in-spring-apps-with-jspecify-and-null-away)) and also supports JDK 17 and 21, and can't practically ensure all users are going to pass the `-XD` flag.

-------------

PR Comment: https://git.openjdk.org/jdk21u-dev/pull/1930#issuecomment-3156513824