[jdk21u-dev] RFR: 8311906: Improve robustness of String constructors with mutable array inputs

Goetz Lindenmaier goetz at openjdk.org
Sat Nov 1 10:08:43 UTC 2025


I backport this for parity with 21.0.10-oracle.

I had to resolve and adapt the change to the CSR for 21, that differes from the CSR for 22.
In addition, I include four follow-up changes. All steps are seperated into individual commits.
In detail:

**Resolved two files (first commit)**

src/java.base/share/classes/java/lang/String.java

Resolved complex code in
  private String(Charset charset, byte[] bytes, int offset, int length)
at line 563++

This is needed because later change
  https://bugs.openjdk.org/browse/JDK-8320570: NegativeArraySizeException decoding >1G UTF8 bytes with non-ascii characters
was already backported.


In 22, this is removed:
`-                byte[] buf = new byte[length << 1];`
In 21, it looks like this:
`-                byte[] buf = StringUTF16.newBytesFor(length);`

I only updated variable buf to utf16 in that line effecitvely keeping 8320570.
After this change, the method looks the same as in 22.0.2.


src/java.base/share/classes/java/lang/StringUTF16.java

Resolved imports.

**Adapted to CSR (second commit)**

The CSRs for 21 and 22 differ. The CSR for 21 does not mention that the documentation is
changed.  Thus, I omit corresponding edits, see extra commit that removes them. Similar
modifications to backports have been done before.

**Follow-ups (commits 3-6)**

The original change has some minor issues.  Notable for example that the test StringRacyConstructor.java is failing. Three follow-up issues exist, and one recursive fix for a test.  These are clean backports on top.  I decided to include them here as working with four dependent PRs is quite cumbersome, and the main change needs review anyways.  I guess reviewing a correct change has some value, too.  
In case a backport to 17 is necessary, all can be grabbed from 21 together this way.

**Adapt 8325590 to 21 (last commit)**

The test modification of 8325590 is not compatible with Java 21.  https://bugs.openjdk.org/browse/JDK-8310047: "Add UTF-32 based Charsets into StandardCharsets" is only in 22.  Removed the corresponding test cases.

-------------

Commit messages:
 - Adapt test in 8325590 to jdk21
 - clean backport 8325590: Regression in round-tripping UTF-16 strings after JDK-8311906
 - clean backport 8321514: UTF16 string gets constructed incorrectly from codepoints if CompactStrings is not enabled
 - clean backport 8322018: Test java/lang/String/CompactString/MaxSizeUTF16String.java fails with -Xcomp
 - clean backport 8321180: Condition for non-latin1 string size too large exception is off by one
 - Modify comments according to diff in CSR for 22 and 21.
 - backport 155abc576a0212932825485380d4e2a9c7dd2fdc

Changes: https://git.openjdk.org/jdk21u-dev/pull/2437/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk21u-dev&pr=2437&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8311906
  Stats: 1525 lines in 16 files changed: 1264 ins; 112 del; 149 mod
  Patch: https://git.openjdk.org/jdk21u-dev/pull/2437.diff
  Fetch: git fetch https://git.openjdk.org/jdk21u-dev.git pull/2437/head:pull/2437

PR: https://git.openjdk.org/jdk21u-dev/pull/2437


More information about the jdk-updates-dev mailing list