[jdk21u-dev] RFR: 8311906: Improve robustness of String constructors with mutable array inputs

[Goetz Lindenmaier]

On Fri, 31 Oct 2025 14:33:19 GMT, Goetz Lindenmaier <goetz at openjdk.org> wrote:

> I backport this for parity with 21.0.10-oracle.
> 
> I had to resolve and adapt the change to the CSR for 21, that differes from the CSR for 22.
> In addition, I include four follow-up changes. All steps are seperated into individual commits.
> In detail:
> 
> **Resolved two files (first commit)**
> 
> src/java.base/share/classes/java/lang/String.java
> 
> Resolved complex code in
>   private String(Charset charset, byte[] bytes, int offset, int length)
> at line 563++
> 
> This is needed because later change
>   https://bugs.openjdk.org/browse/JDK-8320570: NegativeArraySizeException decoding >1G UTF8 bytes with non-ascii characters
> was already backported.
> 
> 
> In 22, this is removed:
> `-                byte[] buf = new byte[length << 1];`
> In 21, it looks like this:
> `-                byte[] buf = StringUTF16.newBytesFor(length);`
> 
> I only updated variable buf to utf16 in that line effecitvely keeping 8320570.
> After this change, the method looks the same as in 22.0.2.
> 
> 
> src/java.base/share/classes/java/lang/StringUTF16.java
> 
> Resolved imports.
> 
> **Adapted to CSR (second commit)**
> 
> The CSRs for 21 and 22 differ. The CSR for 21 does not mention that the documentation is
> changed.  Thus, I omit corresponding edits, see extra commit that removes them. Similar
> modifications to backports have been done before.
> 
> **Follow-ups (commits 3-6)**
> 
> The original change has some minor issues.  Notable for example that the test StringRacyConstructor.java is failing. Three follow-up issues exist, and one recursive fix for a test.  These are clean backports on top.  I decided to include them here as working with four dependent PRs is quite cumbersome, and the main change needs review anyways.  I guess reviewing a correct change has some value, too.  
> In case a backport to 17 is necessary, all can be grabbed from 21 together this way.
> 
> **Adapt 8325590 to 21 (last commit)**
> 
> The test modification of 8325590 is not compatible with Java 21.  https://bugs.openjdk.org/browse/JDK-8310047: "Add UTF-32 based Charsets into StandardCharsets" is only in 22.  Removed the corresponding test cases.

GHA failure: test/jdk/java/util/concurrent/ExecutorService/CloseTest.java failed with 
AssertionError: expected [true] but found [false]
We have seen this fail before, e.g. https://github.com/openjdk-bots/jdk21u-dev/actions/runs/17855005583/attempts/1#summary-50796380616 and I have recorded more failures.  So I assume this failure is unrelated.

-------------

PR Comment: https://git.openjdk.org/jdk21u-dev/pull/2437#issuecomment-3474126248