RFR: 8353835: Implement JEP 500: Prepare to Make Final Mean Final [v13]
Chen Liang
liach at openjdk.org
Sun Nov 16 19:29:21 UTC 2025
On Sun, 16 Nov 2025 17:26:50 GMT, Alan Bateman <alanb at openjdk.org> wrote:
>> Implementation changes for [JEP 500: Prepare to Make Final Mean Final](https://openjdk.org/jeps/500).
>>
>> Field.set (and Lookup.unreflectSetter) are changed to allow/warn/debug/deny when mutating a final instance field. JFR event recorded if final field mutated. Spec updates to Field.set, Field.setAccessible and Module.addOpens to align with the proposal in the JEP.
>>
>> HotSpot is updated to add support for the new command line options. To aid diagnosability, -Xcheck:jni reports a warning and -Xlog:jni=debug logs a message to help identity JNI code that mutates finals. For now, JNI code is allowed to set the "write-protected" fields System.in/out/err without a warning, we can re-visit once we change the System.setIn/setOut/setErr methods to not use JNI (I prefer to keep this separate to this PR because there is a small startup regression to address when changing System.setXXX).
>>
>> There are many new tests. A small number of existing tests are changed to run /othervm as reflectively opening a package isn't sufficient. Changing the tests to /othervm means that jtreg will launch the agent with the command line options to open the package.
>>
>> Testing: tier1-6
>
> Alan Bateman has updated the pull request incrementally with two additional commits since the last revision:
>
> - More wordsmithing
> - Improve IAE exception message
src/java.base/share/man/java.md line 471:
> 469: : Mutation of final fields is possible with the reflection API of the Java Platform.
> 470: _However, it compromises safety and performance in all programs.
> 471: This option allows code_ in the specified modules to mutate final fields by reflection.
Intended that this emphasis ends at "code" instead of the end of the last sentence?
-------------
PR Review Comment: https://git.openjdk.org/jdk/pull/25115#discussion_r2532177598
More information about the security-dev
mailing list