RFR: 8353835: Implement JEP 500: Prepare to Make Final Mean Final [v10]
Alan Bateman
alanb at openjdk.org
Wed Nov 12 08:21:12 UTC 2025
On Tue, 11 Nov 2025 15:01:14 GMT, Chen Liang <liach at openjdk.org> wrote:
> > It's aligned with setAccessible. It's corner case of course but if a JNI attached thread invokes setAccessible with no java frames on the stack, then it is specified to only succeed if the API element is public and declared in a public class in an exported package.
>
> Consider setting the field `java.lang.constant.DirectMethodHandleDesc$Kind.refKind` (public final instance field in public class in exported, non-open package) in 3 ways:
>
> 1. `Field.setAccessible` + `set` in Java code: Now `set` fails without `--add-opens` (not open)
There is a spec issue here. Field.set on final instance fields should align with setAccessible. So assuming setAccessible has succeeded, final field mutation for the caller module is enabled, then Field.set should be specified to succeed when the field is public and its declaring class is public and in a package that its module exports "statically" to the caller module. Right now, we specify that the package must be statically open to the caller which is more than setAccessible requires for this case. I agree this may be surprising. I've drafted spec (and implementation) changes to align them but I want to check with Alex and Ron as it doing it now would require changing a line in the JEP too.
-------------
PR Comment: https://git.openjdk.org/jdk/pull/25115#issuecomment-3520598996
More information about the security-dev
mailing list