[jdk21u-dev] Integrated: 8311906: Improve robustness of String constructors with mutable array inputs

[Goetz Lindenmaier]

On Fri, 31 Oct 2025 14:33:19 GMT, Goetz Lindenmaier <goetz at openjdk.org> wrote:

> I backport this for parity with 21.0.10-oracle.
> 
> I had to resolve and adapt the change to the CSR for 21, that differes from the CSR for 22.
> In addition, I include four follow-up changes. All steps are seperated into individual commits.
> In detail:
> 
> **Resolved two files (first commit)**
> 
> src/java.base/share/classes/java/lang/String.java
> 
> Resolved complex code in
>   private String(Charset charset, byte[] bytes, int offset, int length)
> at line 563++
> 
> This is needed because later change
>   https://bugs.openjdk.org/browse/JDK-8320570: NegativeArraySizeException decoding >1G UTF8 bytes with non-ascii characters
> was already backported.
> 
> 
> In 22, this is removed:
> `-                byte[] buf = new byte[length << 1];`
> In 21, it looks like this:
> `-                byte[] buf = StringUTF16.newBytesFor(length);`
> 
> I only updated variable buf to utf16 in that line effecitvely keeping 8320570.
> After this change, the method looks the same as in 22.0.2.
> 
> 
> src/java.base/share/classes/java/lang/StringUTF16.java
> 
> Resolved imports.
> 
> **Adapted to CSR (second commit)**
> 
> The CSRs for 21 and 22 differ. The CSR for 21 does not mention that the documentation is
> changed.  Thus, I omit corresponding edits, see extra commit that removes them. Similar
> modifications to backports have been done before.
> 
> **Follow-ups (commits 3-6)**
> 
> The original change has some minor issues.  Notable for example that the test StringRacyConstructor.java is failing. Three follow-up issues exist, and one recursive fix for a test.  These are clean backports on top.  I decided to include them here as working with four dependent PRs is quite cumbersome, and the main change needs review anyways.  I guess reviewing a correct change has some value, too.  
> In case a backport to 17 is necessary, all can be grabbed from 21 together this way.
> 
> **Adapt 8325590 to 21 (last commit)**
> 
> The test modification of 8325590 is not compatible with Java 21.  https://bugs.openjdk.org/browse/JDK-8310047: "Add UTF-32 based Charsets into StandardCharsets" is only in 22.  Removed the corresponding test cases.

This pull request has now been integrated.

Changeset: fbc9fad8
Author:    Goetz Lindenmaier <goetz at openjdk.org>
URL:       https://git.openjdk.org/jdk21u-dev/commit/fbc9fad823f5725b1be6682022fe67a551cee880
Stats:     1532 lines in 16 files changed: 1271 ins; 112 del; 149 mod

8311906: Improve robustness of String constructors with mutable array inputs
8321180: Condition for non-latin1 string size too large exception is off by one
8322018: Test java/lang/String/CompactString/MaxSizeUTF16String.java fails with -Xcomp
8321514: UTF16 string gets constructed incorrectly from codepoints if CompactStrings is not enabled
8325590: Regression in round-tripping UTF-16 strings after JDK-8311906

Reviewed-by: rschmelter
Backport-of: 155abc576a0212932825485380d4e2a9c7dd2fdc

-------------

PR: https://git.openjdk.org/jdk21u-dev/pull/2437