there is a bug in openjdk7.

Tue Aug 6 08:30:40 PDT 2013

----- Original Message -----
> On 8/6/13 12:16 AM, Andrew Hughes wrote:
> > The problem is this change:
> > 
> > changeset:   6767:6bf5fa233df0
> > user:        mchung
> > date:        Tue Jul 02 13:23:35 2013 -0700
> > summary:     8014925: Disable sun.reflect.Reflection.getCallerClass(int)
> > with a temporary switch to re-enable it
> > 
> > as mentioned in [1] is missing from OpenJDK 7 u25, though clearly not
> > Oracle u25.
> 
> "clearly not" ;)
> 
> 
> As the summary says, this is a fix for the issue 8014925. A quick look at
> http://bugs.sun.com/view_bug.do?bug_id=8014925 shows
> 
> "Fixed Versions:
> 	
> 7u40 (b33)"
> 
> If this was fixed in a different release, the "Fixed Versions" value would be
> different.
> 
> 
> 
> For anyone following along the development of 7 updates, it's pretty trivial
> to look at the archives, and see that
> 
> a) the fix was pushed on July 2nd:
> http://mail.openjdk.java.net/pipermail/jdk7u-dev/2013-July/006989.html -
> just like the changeset metadata says
> 
> b) the discussion about the change started on June 18th:
> http://mail.openjdk.java.net/pipermail/jdk7u-dev/2013-June/006791.html
> 
> c) that mail starting the discussion explicitly says:
> 
> "[2] 8016814: sun.reflect.Reflection.getCallerClass returns the wrong
> stack frame"
> 
> "This also fixes a regression introduced in 7u25 in which
> getCallerClass(int) is now a Java method that adds an additional frame
> that wasn't taken into account."
> 
> d) and for bonus points, note that Oracle JDK 7u25 was released on June 18th:
> http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
> 
> 
> 
> So, barring a ripple in the time-space continuum, the "clearly not" charge is
> entertainingly wrong.

Except you're comparing two different things.  By the same token, the security
changes weren't posted until after Oracle JDK 7u25 was released [1], but I
assume they're in u25, right?

I don't know if this is the right fix or not.  I'm just going by the little information
that is available from the bug report, which is very confusing.  What is clear
to me from the bug report is there is some difference between OpenJDK u25 and
Oracle u25, and no-one has yet explained what that is.  If it's not this changeset,
which changesets are missing?  Maybe you could provide that information rather than
trying to blame us for not syncing up with something that doesn't exist.

> 
> > The 2.3 JDK
> > tree is synchronised with u25, but versions appear to have been added with
> > no public changes:
> > 
> > icedtea7-2.3/jdk $ hg in ../../jdk7/jdk -r jdk7u25-b32
> > 
> > comparing with ../../jdk7/jdk
> > searching for changes
> > changeset:   6408:173b399abd8a
> > tag:         jdk7u25-b16
> > user:        katleman
> > date:        Tue Jun 11 11:45:28 2013 -0700
> > summary:     Added tag jdk7u25-b30 for changeset 0d68732acbd4
> > 
> > changeset:   6409:55f01444cf58
> > tag:         jdk7u25-b32
> > user:        katleman
> > date:        Wed Jun 12 20:18:31 2013 -0700
> > summary:     Added tag jdk7u25-b16 for changeset 173b399abd8a
> > 
> > $ hg log -R ~/projects/openjdk/upstream/icedtea7-2.3/jdk -k 8016814
> > $
> 
> Yes, as discussed last year on this list,
> 
> "Build # greater than b30 is to address Oracle customer issues and those
> builds are meant only for our customers."
> 
> http://mail.openjdk.java.net/pipermail/jdk7u-dev/2012-May/003197.html

Ok.  So are fixes for this issue being considered "customer issues" and
not shared with OpenJDK?

>  
> > I can pull 8014925 into the 2.3.x tree and do a 2.3.13 release, but there
> > needs to
> > be much better project management of 7u, as this is getting beyond a joke.
> 
> That by itself would be a rather bad idea, I think, for a number of reasons:
> 
> a) Given that 8014925 disables sun.reflect.Reflection.getCallerClass(int),
> while 7u25 doesn't, you'd likely encounter some interesting bug reports
> b) To better understand what kind of bug reports you'd get, I'd suggest
> reading up on the threads around 8014925 on mlvm-dev and core-libs-dev
> c) In particular, make sure you understand 8021946
> 

Then tell me what needs to be pulled in, because clearly OpenJDK u25 is inadequate.

> Anyhow, from reading https://bugzilla.redhat.com/show_bug.cgi?id=976693
> it sounds like Red Hat has already solved this issue as of
> 1.7.0.25-2.4.1.0.el6 for
> RHEL a while ago, so I am curious why the change has not been picked up in
> Icedtea yet, allowing Ubuntu users to benefit from it as well ...
> 

That is IcedTea, for all intents and purposes...

I think you need to re-read the bug report and my preceding e-mails, noting that
the bug report is still open.  As Oracle engineers have also stated, the issue
is fixed in u40 and 2.4.1 is based on u40 b31.  2.3.x is based on u6 with the
addition of the various tags that have been published to the 7u repositories,
up to u25.  The problem lies in that OpenJDK u25 does NOT include whatever
change fixes this bug but the proprietary u25 does.

> cheers,
> dalibor topic
> --
> Oracle <http://www.oracle.com>
> Dalibor Topic | Principal Product Manager
> Phone: +494089091214 <tel:+494089091214> | Mobile: +491737185961
> <tel:+491737185961>
> Oracle Java Platform Group
> 
> ORACLE Deutschland B.V. & Co. KG | Kühnehöfe 5 | 22761 Hamburg
> 
> ORACLE Deutschland B.V. & Co. KG
> Hauptverwaltung: Riesstr. 25, D-80992 München
> Registergericht: Amtsgericht München, HRA 95603
> Geschäftsführer: Jürgen Kunz
> 
> Komplementärin: ORACLE Deutschland Verwaltung B.V.
> Hertogswetering 163/167, 3543 AS Utrecht, Niederlande
> Handelsregister der Handelskammer Midden-Niederlande, Nr. 30143697
> Geschäftsführer: Alexander van der Ven, Astrid Kepper, Val Maher
> 
> Green Oracle <http://www.oracle.com/commitment> Oracle is committed to
> developing practices and products that help protect the environment
> 

-- 
Andrew :)

Free Java Software Engineer
Red Hat, Inc. (http://www.redhat.com)

PGP Key: 248BDC07 (https://keys.indymedia.org/)
Fingerprint = EC5A 1F5E C0AD 1D15 8F1F  8F91 3B96 A578 248B DC07