12 changed files with 5256 additions and 1222 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/shenandoah8u422-b05.tar.xz
+SOURCES/shenandoah8u452-b09.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz
--- a/.java-1.8.0-openjdk.metadata
+++ b/.java-1.8.0-openjdk.metadata
@ -1,2 +1,2 @@
-e2828a59a56b737f58f33dc21f654e92bdfc085e SOURCES/shenandoah8u422-b05.tar.xz
+c09d806f1a991cd77d3f15bb35ff69cb9d1bdbc0 SOURCES/shenandoah8u452-b09.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz
--- a/SOURCES/NEWS
+++ b/SOURCES/NEWS
@ -3,6 +3,478 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 New in release OpenJDK 8u452 (2025-04-15):
 ===========================================
 Live versions of these release notes can be found at:
  * https://bit.ly/openjdk8u452
 * CVEs
  - CVE-2025-21587
  - CVE-2025-30691
  - CVE-2025-30698
 * Changes
  - JDK-8037013: [TESTBUG] Fix test/java/lang/ClassLoader/Assert.sh on AIX
  - JDK-8048215: [TESTBUG] java/lang/management/ManagementFactory/ThreadMXBeanProxy.java Expected non-null LockInfo
  - JDK-8068305: [TEST_BUG] Test java/awt/Mixing/HWDisappear.java fails with GTKL&F
  - JDK-8212096: javax/net/ssl/ServerName/SSLEngineExplorerMatchedSNI.java failed intermittently due to SSLException: Tag mismatch
  - JDK-8227651: Tests fail with SSLProtocolException: Input record too big
  - JDK-8240235: jdk.test.lib.util.JarUtils updates jar files incorrectly
  - JDK-8244966: Add .vscode to .hgignore and .gitignore
  - JDK-8250825: C2 crashes with assert(field != __null) failed: missing field
  - JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
  - JDK-8261020: Wrong format parameter in create_emergency_chunk_path
  - JDK-8265019: Update tests for additional TestNG test permissions
  - JDK-8266881: Enable debug log for SSLEngineExplorerMatchedSNI.java
  - JDK-8268457: XML Transformer outputs Unicode supplementary character incorrectly to HTML
  - JDK-8285756: clean up use of bad arguments for `@clean` in langtools tests
  - JDK-8309841: Jarsigner should print a warning if an entry is removed
  - JDK-8316193: jdk/jfr/event/oldobject/TestListenerLeak.java java.lang.Exception: Could not find leak
  - JDK-8326110: [8u] The Marlin tests should be updated after JDK-8241307
  - JDK-8337494: Clarify JarInputStream behavior
  - JDK-8337692: Better TLS connection support
  - JDK-8338430: Improve compiler transformations
  - JDK-8339560: Unaddressed comments during code review of JDK-8337664
  - JDK-8339637: (tz) Update Timezone Data to 2024b
  - JDK-8339644: Improve parsing of Day/Month in tzdata rules
  - JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract
  - JDK-8340552: Harden TzdbZoneRulesCompiler against missing zone names
  - JDK-8340660: [8u] Test com/sun/jdi/PrivateTransportTest.sh fails on MacOS
  - JDK-8342562: Enhance Deflater operations
  - JDK-8343007: Enhance Buffered Image handling
  - JDK-8345504: Bump update version of OpenJDK: 8u452
  - JDK-8346140: [8u] tools/jar/ExtractFilesTest.java and tools/jar/MultipleManifestTest.java fails with jtreg5.1
  - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
  - JDK-8347847: Enhance jar file support
  - JDK-8347965: (tz) Update Timezone Data to 2025a
  - JDK-8348211: [8u] sun/management/jmxremote/startstop/JMXStartStopTest.java fails after backport of JDK-8066708
  - JDK-8349166: Bad indentation in backport of JDK-8250825
  - JDK-8350816: [8u] Update TzdbZoneRulesCompiler to ignore HST/EST/MST links
  - JDK-8352097: (tz) zone.tab update missed in 2025a backport
  - JDK-8353433: XCG currency code not recognized in JDK 8u
 Notes on individual issues:
 ===========================
 security-libs/java.security:
 JDK-8309841: Jarsigner should print a warning if an entry is removed
 ====================================================================
 In previous OpenJDK releases, the jarsigner tool did not detect the
 case where a file was removed from a signed JAR file but its signature
 was still present. With this release, `jarsigner -verify` checks that
 every signature has a matching file entry and prints a warning if this
 is not the case. The `-verbose` option can also be added to the
 command to see the names of the mismatched entries.
 security-libs/javax.net.ssl:
 JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
 =============================================================================
 In accordance with similar plans recently announced by Google,
 Mozilla, Apple and Microsoft, the JDK will not trust Transport Layer
 Security (TLS) certificates issued after the 15th of April 2025 which
 are anchored by Camerfirma root certificates.
 Certificates issued on or before April 15th, 2025 will continue to
 be trusted until they expire.
 If a server's certificate chain is anchored by an affected
 certificate, attempts to negotiate a TLS session will fail with an
 Exception that indicates the trust anchor is not trusted. For example,
 "TLS server certificate issued after 2025-04-15 and anchored by a
 distrusted legacy Camerfirma root CA: CN=Chambers of Commerce Root -
 2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see
 current address at www.camerfirma.com/address), C=EU"
 To check whether a certificate in a JDK keystore is affected by this
 change, you can the `keytool` utility:
 keytool -v -list -alias <your_server_alias> -keystore <your_keystore_filename>
 If any of the certificates in the chain are affected by this change,
 then you will need to update the certificate or contact the
 organisation responsible for managing the certificate.
 These restrictions apply to the following Camerfirma root certificates
 included in the JDK:
 Alias name: camerfirmachamberscommerceca [jdk]
 CN=Chambers of Commerce Root
 OU=http://www.chambersign.org
 O=AC Camerfirma SA CIF A82743287
 C=EU
 SHA256: 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3
 Alias name: camerfirmachambersca [jdk]
 CN=Chambers of Commerce Root - 2008
 O=AC Camerfirma S.A.
 SERIALNUMBER=A82743287
 L=Madrid (see current address at www.camerfirma.com/address)
 C=EU
 SHA256: 06:3E:4A:FA:C4:91:DF:D3:32:F3:08:9B:85:42:E9:46:17:D8:93:D7:FE:94:4E:10:A7:93:7E:E2:9D:96:93:C0
 Alias name: camerfirmachambersignca [jdk]
 CN=Global Chambersign Root - 2008
 O=AC Camerfirma S.A.
 SERIALNUMBER=A82743287
 L=Madrid (see current address at www.camerfirma.com/address)
 C=EU
 SHA256: 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA
 Users can, *at their own risk*, remove this restriction by modifying
 the `java.security` configuration file (or override it by using the
 `java.security.properties` system property) so "CAMERFIRMA_TLS" is no
 longer listed in the `jdk.security.caDistrustPolicies` security
 property.
 core-libs/java.time:
 JDK-8339637: (tz) Update Timezone Data to 2024b
 ===============================================
 This OpenJDK release upgrades the in-tree copy of the IANA timezone
 database to 2024b.  This timezone update is primarily concerned with
 improving historical data for Mexico, Monogolia and Portugal. It also
 makes Asia/Choibalsan an alias for Asia/Ulaanbaatar and makes the MET
 timezone the same as CET.
 The 2024b update also makes a number of legacy timezone IDs equal to
 geographical names rather than fixed offsets, as follows:
 * EST => America/Panama instead of -5:00
 * MST => America/Phoenix instead of -7:00
 * HST => Pacific/Honolulu instead of -10:00
 For long term support releases of OpenJDK, this change is overridden
 locally to retain the existing fixed offset mapping.
 New in release OpenJDK 8u442 (2025-01-21):
 ===========================================
 Live versions of these release notes can be found at:
  * https://bit.ly/openjdk8u442
 * Changes
  - JDK-8048003: test/compiler/8009761/Test8009761.java failed with: java.lang.RuntimeException: static java.lang.Object Test8009761.m3(boolean,boolean) not compiled
  - JDK-8058322: Zero name_index item of MethodParameters attribute cause MalformedParameterException.
  - JDK-8066708: JMXStartStopTest fails to connect to port 38112
  - JDK-8133287: (fs) java/nio/file/Files/probeContentType/ParallelProbes.java should use othervm mode
  - JDK-8189687: Swing: Invalid position of candidate pop-up of InputMethod in Hi-DPI on Windows
  - JDK-8209023: fix 2 compiler tests to avoid JDK-8208690
  - JDK-8239312: [macOS] javax/swing/JFrame/NSTexturedJFrame/NSTexturedJFrame.java
  - JDK-8260380: Upgrade to LittleCMS 2.12
  - JDK-8315731: Open source several Swing Text related tests
  - JDK-8335428: Enhanced Building of Processes
  - JDK-8335912, JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
  - JDK-8336564: Enhance mask blit functionality redux
  - JDK-8338402: GHA: some of bundles may not get removed
  - JDK-8339133: [8u] Profiler crashes at guarantee(is_result_safe || is_in_asgct()): unsafe access to zombie method
  - JDK-8339180: Enhanced Building of Processes: Follow-on Issue
  - JDK-8339394: Bump update version of OpenJDK: 8u442
  - JDK-8339882: Replace ThreadLocalStorage::thread with Thread::current_or_null in jdk8 backport of JDK-8183925
  - JDK-8340815: Add SECURITY.md file
  - JDK-8342822: jdk8u432-b06 does not compile on AIX
  - JDK-8342841: [8u] Separate jdk_security_infra tests from jdk_tier1
 Notes on individual issues:
 ===========================
 core-libs/java.util.jar:
 JDK-8335912/JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
 ===================================================================================================================
 In previous OpenJDK releases, when the jar tool extracted files from
 an archive, it would overwrite any existing files with the same name
 in the target directory. With this release, a new option ('-k') may be
 specified so that existing files are not overwritten.
 The option may be specified as in the following example:
 * jar xkf foo.jar
 By default, the old behaviour remains in place and files will be
 overwritten.
 New in release OpenJDK 8u432 (2024-10-15):
 ===========================================
 Live versions of these release notes can be found at:
  * https://bit.ly/openjdk8u432
 * CVEs
  - CVE-2024-21208
  - CVE-2024-21210
  - CVE-2024-21217
  - CVE-2024-21235
 * Security fixes
  - JDK-8290367, JDK-8332643: Update default value and extend the scope of com.sun.jndi.ldap.object.trustSerialData system property
  - JDK-8313626, JDK-8307769: C2 crash due to unexpected exception control flow
  - JDK-8328286: Enhance HTTP client
  - JDK-8328544: Improve handling of vectorization
  - JDK-8328726: Better Kerberos support
  - JDK-8331446: Improve deserialization support
  - JDK-8332644: Improve graph optimizations
  - JDK-8335713: Enhance vectorization analysis
 * Other changes
  - JDK-4660158: TTY: NumberFormatException while trying to set values by 'set' command
  - JDK-6544871: java/awt/event/KeyEvent/KeyTyped/CtrlASCII.html fails from jdk b09 on windows.
  - JDK-7188098: TEST_BUG: closed/javax/sound/midi/Synthesizer/Receiver/bug6186488.java fails
  - JDK-8021775: compiler/8009761/Test8009761.java  "Failed: init recursive calls: 51. After deopt 50"
  - JDK-8030204: com/sun/jdi/JdbExprTest.sh: Required output "Can\\'t convert 2147483648 to int" not found
  - JDK-8030795: java/nio/file/Files/probeContentType/ForceLoad.java failing with ServiceConfigurationError without jtreg -agentvm option
  - JDK-8035395: sun/management/jmxremote/startstop/JMXStartStopTest.java fails intermittently: Port already in use
  - JDK-8075511: Enable -Woverloaded-virtual C++ warning for HotSpot build
  - JDK-8137329: [windows] Build broken on VS2010 after  "8046148: JEP 158: Unified JVM Logging"
  - JDK-8145919: sun/management/jmxremote/bootstrap/RmiSslBootstrapTest failed with Connection failed for no credentials
  - JDK-8152207: Perform array bound checks while getting a length of bytecode instructions
  - JDK-8193682: Infinite loop in ZipOutputStream.close()
  - JDK-8196770: Add JNDI test com/sun/jndi/ldap/blits/AddTests/AddNewEntry.java
  - JDK-8221903: PIT: javax/swing/RepaintManager/IconifyTest/IconifyTest.java fails on ubuntu18.04
  - JDK-8233364: Fix undefined behavior in Canonicalizer::do_ShiftOp
  - JDK-8238274: (sctp) JDK-7118373 is not fixed for SctpChannel
  - JDK-8251188: Update LDAP tests not to use wildcard addresses
  - JDK-8264328: Broken license in javax/swing/JComboBox/8072767/bug8072767.java
  - JDK-8266248: Compilation failure in PLATFORM_API_MacOSX_MidiUtils.c with Xcode 12.5
  - JDK-8278794: Infinite loop in DeflaterOutputStream.finish()
  - JDK-8279164: Disable TLS_ECDH_* cipher suites
  - JDK-8281096: Flags introduced by configure script are not passed to ADLC build
  - JDK-8284771: java/util/zip/CloseInflaterDeflaterTest.java failed with "AssertionError: Expected IOException to be thrown, but nothing was thrown"
  - JDK-8298887: On the latest macOS+XCode the Robot API may report wrong colors
  - JDK-8299677: Formatter.format might take a long time to format an integer or floating-point
  - JDK-8305400: ISO 4217 Amendment 175 Update
  - JDK-8305931: jdk/jfr/jcmd/TestJcmdDumpPathToGCRoots.java failed with "Expected chains but found none"
  - JDK-8307779: Relax the java.awt.Robot specification
  - JDK-8309138: Fix container tests for jdks with symlinked conf dir
  - JDK-8311666: Disabled tests in test/jdk/sun/java2d/marlin
  - JDK-8315117: Update Zlib Data Compression Library to Version 1.3
  - JDK-8315863: [GHA] Update checkout action to use v4
  - JDK-8316328: Test jdk/jfr/event/oldobject/TestSanityDefault.java times out for some heap sizes
  - JDK-8318039: GHA: Bump macOS and Xcode versions
  - JDK-8318951: Additional negative value check in JPEG decoding
  - JDK-8320964: sun/tools/native2ascii/Native2AsciiTests.sh fails on Japanese
  - JDK-8321480: ISO 4217 Amendment 176 Update
  - JDK-8324632: Update Zlib Data Compression Library to Version 1.3.1
  - JDK-8324723: GHA: Upgrade some actions to avoid deprecated Node 16
  - JDK-8326351: Update the Zlib version in open/src/java.base/share/legal/zlib.md to 1.3.1
  - JDK-8326521: JFR: CompilerPhase event test fails on windows 32 bit
  - JDK-8326529: JFR: Test for CompilerCompile events fails due to time out
  - JDK-8327007: javax/swing/JSpinner/8008657/bug8008657.java fails
  - JDK-8330415: Update system property for Java SE specification maintenance version
  - JDK-8331730: [8u] GHA: update sysroot for cross builds to Debian bullseye
  - JDK-8333126: Bump update version of OpenJDK: 8u432
  - JDK-8333669: [8u] GHA: Dead VS2010 download link
  - JDK-8333724: Problem list security/infra/java/security/cert/CertPathValidator/certification/CAInterop.java#teliasonerarootcav1
  - JDK-8334653: ISO 4217 Amendment 177 Update
  - JDK-8334905: [8u] The test java/awt/Mixing/AWT_Mixing/JButtonOverlapping.java started to fail after 8159690
  - JDK-8335851: [8u] Test JMXStartStopTest.java fails after JDK-8334415
  - JDK-8335894: [8u] Fix SupplementalJapaneseEraTest.java for jdks with symlinked conf dir
  - JDK-8336928: GHA: Bundle artifacts removal broken
  - JDK-8337110: [8u] TestNoEagerReclaimOfHumongousRegions.java should be in gc/g1 directory
  - JDK-8337312: [8u] Windows x86 VS2010 build broken by JDK-8320097
  - JDK-8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs
  - JDK-8338144: [8u] Remove duplicate license files
  - JDK-8341057: Add 2 SSL.com TLS roots
  - JDK-8341059: Change Entrust TLS distrust date to November 12, 2024
 Notes on individual issues:
 ===========================
 security-libs/javax.net.ssl:
 JDK-8279164: Disable TLS_ECDH_* cipher suites
 =============================================
 The TLS_ECDH cipher suites do not preserve forward secrecy and are
 rarely used in practice. With this release, they are disabled by
 adding "ECDH" to the `jdk.tls.disabledAlgorithms` security property in
 the `java.security` configuration file. Attempts to use these suites
 with this release will result in a `SSLHandshakeException` being
 thrown. Note that ECDH cipher suites which use RC4 were already
 disabled prior to this change.
 Users can, *at their own risk*, remove this restriction by modifying
 the `java.security` configuration file (or override it by using the
 `java.security.properties` system property) so "ECDH" is no longer
 listed in the `jdk.tls.disabledAlgorithms` security property.
 This change has no effect on TLS_ECDHE cipher suites, which remain
 enabled by default.
 JDK-8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs
 JDK-8341059: Change Entrust TLS distrust date to November 12, 2024
 ====================================================================================================
 In accordance with similar plans recently announced by Google and
 Mozilla, the JDK will not trust Transport Layer Security (TLS)
 certificates issued after the 11th of November 2024 which are anchored
 by Entrust root certificates.  This includes certificates branded as
 AffirmTrust, which are managed by Entrust.
 Certificates issued on or before November 11th, 2024 will continue to
 be trusted until they expire.
 If a server's certificate chain is anchored by an affected
 certificate, attempts to negotiate a TLS session will fail with an
 Exception that indicates the trust anchor is not trusted. For example,
 "TLS server certificate issued after 2024-11-11 and anchored by a
 distrusted legacy Entrust root CA: CN=Entrust.net Certification
 Authority (2048), OU=(c) 1999 Entrust.net Limited,
 OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.),
 O=Entrust.net"
 To check whether a certificate in a JDK keystore is affected by this
 change, you can the `keytool` utility:
 keytool -v -list -alias <your_server_alias> -keystore <your_keystore_filename>
 If any of the certificates in the chain are affected by this change,
 then you will need to update the certificate or contact the
 organisation responsible for managing the certificate.
 These restrictions apply to the following Entrust root certificates
 included in the JDK:
 Alias name: entrustevca [jdk]
 CN=Entrust Root Certification Authority
 OU=(c) 2006 Entrust, Inc.
 OU=www.entrust.net/CPS is incorporated by reference
 O=Entrust, Inc.
 C=US
 SHA256: 73:C1:76:43:4F:1B:C6:D5:AD:F4:5B:0E:76:E7:27:28:7C:8D:E5:76:16:C1:E6:E6:14:1A:2B:2C:BC:7D:8E:4C
 Alias name: entrustrootcaec1 [jdk]
 CN=Entrust Root Certification Authority - EC1
 OU=(c) 2012 Entrust, Inc. - for authorized use only
 OU=See www.entrust.net/legal-terms
 O=Entrust, Inc.
 C=US
 SHA256: 02:ED:0E:B2:8C:14:DA:45:16:5C:56:67:91:70:0D:64:51:D7:FB:56:F0:B2:AB:1D:3B:8E:B0:70:E5:6E:DF:F5
 Alias name: entrustrootcag2 [jdk]
 CN=Entrust Root Certification Authority - G2
 OU=(c) 2009 Entrust, Inc. - for authorized use only
 OU=See www.entrust.net/legal-terms
 O=Entrust, Inc.
 C=US
 SHA256: 43:DF:57:74:B0:3E:7F:EF:5F:E4:0D:93:1A:7B:ED:F1:BB:2E:6B:42:73:8C:4E:6D:38:41:10:3D:3A:A7:F3:39
 Alias name: entrustrootcag4 [jdk]
 CN=Entrust Root Certification Authority - G4
 OU=(c) 2015 Entrust, Inc. - for authorized use only
 OU=See www.entrust.net/legal-terms
 O=Entrust, Inc.
 C=US
 SHA256: DB:35:17:D1:F6:73:2A:2D:5A:B9:7C:53:3E:C7:07:79:EE:32:70:A6:2F:B4:AC:42:38:37:24:60:E6:F0:1E:88
 Alias name: entrust2048ca [jdk]
 CN=Entrust.net Certification Authority (2048)
 OU=(c) 1999 Entrust.net Limited
 OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)
 O=Entrust.net
 SHA256: 6D:C4:71:72:E0:1C:BC:B0:BF:62:58:0D:89:5F:E2:B8:AC:9A:D4:F8:73:80:1E:0C:10:B9:C8:37:D2:1E:B1:77
 Alias name: affirmtrustcommercialca [jdk]
 CN=AffirmTrust Commercial
 O=AffirmTrust
 C=US
 SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7
 Alias name: affirmtrustnetworkingca [jdk]
 CN=AffirmTrust Networking
 O=AffirmTrust
 C=US
 SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B
 Alias name: affirmtrustpremiumca [jdk]
 CN=AffirmTrust Premium
 O=AffirmTrust
 C=US
 SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A
 Alias name: affirmtrustpremiumeccca [jdk]
 CN=AffirmTrust Premium ECC
 O=AffirmTrust
 C=US
 SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23
 Users can, *at their own risk*, remove this restriction by modifying
 the `java.security` configuration file (or override it by using the
 `java.security.properties` system property) so "ENTRUST_TLS" is no
 longer listed in the `jdk.security.caDistrustPolicies` security
 property.
 security-libs/java.security:
 JDK-8341057: Add 2 SSL.com TLS roots
 ====================================
 The following root certificates have been added to the cacerts
 truststore:
 Name: SSL.com
 Alias Name: ssltlsrootecc2022
 Distinguished Name: CN=SSL.com TLS ECC Root CA 2022, O=SSL Corporation, C=US
 Name: SSL.com
 Alias Name: ssltlsrootrsa2022
 Distinguished Name: CN=SSL.com TLS RSA Root CA 2022, O=SSL Corporation, C=US
 client-libs:
 JDK-8307779: Relax the java.awt.Robot specification
 ===================================================
 This release of OpenJDK 8 updates to the latest maintenance release of
 the Java 8 specification. This relaxes the specification of three
 methods in the `java.awt.Robot` class - `mouseMove(int,int)`,
 `getPixelColor(int,int)` and `createScreenCapture(Rectangle)` - to
 allow these methods to fail when the desktop environment does not
 permit moving the mouse pointer or capturing screen content.
 core-libs/javax.naming:
 JDK-8290367, JDK-8332643: Update default value and extend the scope of com.sun.jndi.ldap.object.trustSerialData system property
 ===============================================================================================================================
 With this OpenJDK release, the JDK implementation of the LDAP provider
 no longer supports the deserialisation of Java objects by
 default. This is achieved by the system property
 `com.sun.jndi.ldap.object.trustSerialData` being set to `false` by
 default.
 Note that this release also increases the scope of the
 `com.sun.jndi.ldap.object.trustSerialData` to cover the reconstruction
 of RMI remote objects from the `javaRemoteLocation` LDAP attribute.
 The result of this change is that transparent deserialisation of Java
 objects will require an explicit opt-in. Applications that wish to
 reconstruct Java objects and RMI stubs from LDAP attributes will need
 to set the `com.sun.jndi.ldap.object.trustSerialData` to `true`.
 core-libs/java.net:
 JDK-8328286: Enhance HTTP client
 ================================
 This OpenJDK release limits the maximum header field size accepted by
 the HTTP client within the JDK for all supported versions of the HTTP
 protocol. The header field size is computed as the sum of the size of
 the uncompressed header name, the size of the uncompressed header
 value and a overhead of 32 bytes for each field section line. If a
 peer sends a field section that exceeds this limit, a
 `java.net.ProtocolException` will be raised.
 This release also introduces a new system property,
 `jdk.http.maxHeaderSize`. This property can be used to alter the
 maximum header field size (in bytes) or disable it by setting the
 value to zero or a negative value. The default value is 393,216 bytes
 or 384kB.
 core-libs/java.util.jar:
 JDK-8193682: Infinite loop in ZipOutputStream.close()
 =====================================================
 In previous releases, the `DeflaterOutputStream.close()`,
 `GZIPOutputStream.finish()` and `ZipOutputStream.closeEntry()` methods
 did not close the associated default JDK compressor when an exception
 was thrown during closure.  With this release, the default compressor
 is closed before propogating the Throwable up the stack. In the case
 of `ZipOutputStream`, this only happens when the exception is not a
 `ZipException`.
 New in release OpenJDK 8u422 (2024-07-16):
 ===========================================
 Live versions of these release notes can be found at:
--- a/SOURCES/fips-8u-6d1aade0648.patch
+++ b/SOURCES/fips-8u-6d1aade0648.patch
@ -1,5 +1,5 @@
 diff --git a/common/autoconf/configure.ac b/common/autoconf/configure.ac
-index 151e5a109f8..a8761b500e0 100644
+index 151e5a109f..a8761b500e 100644
 --- a/common/autoconf/configure.ac
 +++ b/common/autoconf/configure.ac
@@ -212,6 +212,7 @@ LIB_SETUP_FREETYPE
@ -11,10 +11,10 @@ index 151e5a109f8..a8761b500e0 100644
 LIB_SETUP_ON_WINDOWS
 diff --git a/common/autoconf/generated-configure.sh b/common/autoconf/generated-configure.sh
-index 71fabf4dbb3..17f4f50673d 100644
+index c6144b1968..9ac55d20d3 100644
 --- a/common/autoconf/generated-configure.sh
 +++ b/common/autoconf/generated-configure.sh
-@@ -651,6 +651,9 @@ LLVM_CONFIG
+@@ -655,6 +655,9 @@ ENABLE_LIBFFI_BUNDLING
 LIBFFI_LIBS
 LIBFFI_CFLAGS
 STATIC_CXX_SETTING
@ -24,15 +24,15 @@ index 71fabf4dbb3..17f4f50673d 100644
 LIBDL
 LIBM
 LIBZIP_CAN_USE_MMAP
-@@ -1111,6 +1114,7 @@ with_fontconfig
+@@ -1119,6 +1122,7 @@ with_fontconfig
 with_fontconfig_include
 with_giflib
 with_zlib
 +enable_sysconf_nss
 with_stdc__lib
- with_msvcr_dll
+ with_libffi
- with_msvcp_dll
+ with_libffi_include
-@@ -1218,6 +1222,8 @@ FREETYPE_CFLAGS
+@@ -1232,6 +1236,8 @@ FREETYPE_CFLAGS
 FREETYPE_LIBS
 ALSA_CFLAGS
 ALSA_LIBS
@ -41,16 +41,16 @@ index 71fabf4dbb3..17f4f50673d 100644
 LIBFFI_CFLAGS
 LIBFFI_LIBS
 CCACHE'
-@@ -1871,6 +1877,8 @@ Optional Features:
+@@ -1874,6 +1880,8 @@ Optional Features:
                           disable bundling of the freetype library with the
                           build result [enabled on Windows or when using
                           --with-freetype, disabled otherwise]
 +  --enable-sysconf-nss    build the System Configurator (libsysconf) using the
 +                          system NSS library if available [disabled]
-   --enable-sjavac         use sjavac to do fast incremental compiles
+   --enable-libffi-bundling
-                           [disabled]
+                           enable bundling of libffi.so to make the built JDK
-   --disable-precompiled-headers
+                           runnable on more systems
-@@ -2115,6 +2123,8 @@ Some influential environment variables:
+@@ -2129,6 +2137,8 @@ Some influential environment variables:
               linker flags for FREETYPE, overriding pkg-config
   ALSA_CFLAGS C compiler flags for ALSA, overriding pkg-config
   ALSA_LIBS   linker flags for ALSA, overriding pkg-config
@ -59,60 +59,7 @@ index 71fabf4dbb3..17f4f50673d 100644
   LIBFFI_CFLAGS
               C compiler flags for LIBFFI, overriding pkg-config
   LIBFFI_LIBS linker flags for LIBFFI, overriding pkg-config
-@@ -2879,6 +2889,52 @@ $as_echo "$ac_res" >&6; }
+@@ -4109,6 +4119,11 @@ fi
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 } # ac_fn_c_check_header_compile
 +
 +# ac_fn_c_try_link LINENO
 +# -----------------------
 +# Try to link conftest.$ac_ext, and return whether this succeeded.
 +ac_fn_c_try_link ()
 +{
 +  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
 +  rm -f conftest.$ac_objext conftest$ac_exeext
 +  if { { ac_try="$ac_link"
 +case "(($ac_try" in
 +  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
 +  *) ac_try_echo=$ac_try;;
 +esac
 +eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
 +$as_echo "$ac_try_echo"; } >&5
 +  (eval "$ac_link") 2>conftest.err
 +  ac_status=$?
 +  if test -s conftest.err; then
 +    grep -v '^ *+' conftest.err >conftest.er1
 +    cat conftest.er1 >&5
 +    mv -f conftest.er1 conftest.err
 +  fi
 +  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 +  test $ac_status = 0; } && {
 +	 test -z "$ac_c_werror_flag" ||
 +	 test ! -s conftest.err
 +       } && test -s conftest$ac_exeext && {
 +	 test "$cross_compiling" = yes ||
 +	 test -x conftest$ac_exeext
 +       }; then :
 +  ac_retval=0
 +else
 +  $as_echo "$as_me: failed program was:" >&5
 +sed 's/^/| /' conftest.$ac_ext >&5
 +
 +	ac_retval=1
 +fi
 +  # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
 +  # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
 +  # interfere with the next link command; also delete a directory that is
 +  # left behind by Apple's compiler.  We do this before executing the actions.
 +  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
 +  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 +  as_fn_set_status $ac_retval
 +
 +} # ac_fn_c_try_link
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
@@ -4049,6 +4105,11 @@ fi
@ -124,7 +71,7 @@ index 71fabf4dbb3..17f4f50673d 100644
 #
 # Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-@@ -49304,6 +49365,157 @@ fi
+@@ -50141,6 +50156,157 @@ fi
   LIBS="$save_LIBS"
@ -246,7 +193,7 @@ index 71fabf4dbb3..17f4f50673d 100644
 +/* end confdefs.h.  */
 +#include <nss3/pk11pub.h>
 +int
-+main ()
+main (void)
 +{
 +SECMOD_GetSystemFIPSEnabled()
 +  ;
@ -283,10 +230,10 @@ index 71fabf4dbb3..17f4f50673d 100644
   #
   # statically link libstdc++ before C++ ABI is stablized on Linux unless
 diff --git a/common/autoconf/libraries.m4 b/common/autoconf/libraries.m4
-index 6efae578ea9..0080846255b 100644
+index 4ed8b4fdd6..caf293be72 100644
 --- a/common/autoconf/libraries.m4
 +++ b/common/autoconf/libraries.m4
-@@ -1067,3 +1067,63 @@ AC_DEFUN_ONCE([LIB_SETUP_ON_WINDOWS],
+@@ -1216,3 +1216,63 @@ AC_DEFUN_ONCE([LIB_SETUP_ON_WINDOWS],
     BASIC_DEPRECATED_ARG_WITH([dxsdk-include])
   fi
 ])
@ -351,12 +298,12 @@ index 6efae578ea9..0080846255b 100644
 +  AC_SUBST(USE_SYSCONF_NSS)
 +])
 diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
-index 506cf617087..7241593b1a4 100644
+index 8da3ac32a0..4d081d1b84 100644
 --- a/common/autoconf/spec.gmk.in
 +++ b/common/autoconf/spec.gmk.in
-@@ -312,6 +312,10 @@ CUPS_CFLAGS:=@CUPS_CFLAGS@
+@@ -317,6 +317,10 @@ ENABLE_LIBFFI_BUNDLING:=@ENABLE_LIBFFI_BUNDLING@
- ALSA_LIBS:=@ALSA_LIBS@
+ LIBFFI_LIB_DIR:=@LIBFFI_LIB_DIR@
- ALSA_CFLAGS:=@ALSA_CFLAGS@
+ LIBFFI_LIB_FILE:=@LIBFFI_LIB_FILE@
 +USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
 +NSS_LIBS:=@NSS_LIBS@
@ -366,7 +313,7 @@ index 506cf617087..7241593b1a4 100644
 # Source file for cacerts
 diff --git a/common/bin/compare_exceptions.sh.incl b/common/bin/compare_exceptions.sh.incl
-index 3b79a526f56..d2a0e39b206 100644
+index 3b79a526f5..d2a0e39b20 100644
 --- a/common/bin/compare_exceptions.sh.incl
 +++ b/common/bin/compare_exceptions.sh.incl
@@ -280,6 +280,7 @@ ACCEPTED_SMALL_SIZE_DIFF="
@ -402,7 +349,7 @@ index 3b79a526f56..d2a0e39b206 100644
 ./jre/lib/sparcv9/libunpack.so
 ./jre/lib/sparcv9/libverify.so
 diff --git a/common/nb_native/nbproject/configurations.xml b/common/nb_native/nbproject/configurations.xml
-index d2beed0b93a..3b6aef98d9a 100644
+index d2beed0b93..3b6aef98d9 100644
 --- a/common/nb_native/nbproject/configurations.xml
 +++ b/common/nb_native/nbproject/configurations.xml
@@ -53,6 +53,9 @@
@ -428,10 +375,10 @@ index d2beed0b93a..3b6aef98d9a 100644
             ex="false"
             tool="0"
 diff --git a/jdk/make/lib/SecurityLibraries.gmk b/jdk/make/lib/SecurityLibraries.gmk
-index b0b85d80448..47a41d7518d 100644
+index 84abb7e76b..cb4531b880 100644
 --- a/jdk/make/lib/SecurityLibraries.gmk
 +++ b/jdk/make/lib/SecurityLibraries.gmk
-@@ -289,3 +289,34 @@ ifeq ($(OPENJDK_TARGET_OS), solaris)
+@@ -303,3 +303,34 @@ ifeq ($(OPENJDK_TARGET_OS), solaris)
   endif
 endif
@ -468,7 +415,7 @@ index b0b85d80448..47a41d7518d 100644
 +
 diff --git a/jdk/make/mapfiles/libsystemconf/mapfile-vers b/jdk/make/mapfiles/libsystemconf/mapfile-vers
 new file mode 100644
-index 00000000000..a65ceb3b78c
+index 0000000000..a65ceb3b78
 --- /dev/null
 +++ b/jdk/make/mapfiles/libsystemconf/mapfile-vers
@@ -0,0 +1,35 @@
@ -508,7 +455,7 @@ index 00000000000..a65ceb3b78c
 +		*;
 +};
 diff --git a/jdk/src/share/classes/java/security/Security.java b/jdk/src/share/classes/java/security/Security.java
-index 0db09da7061..813b907db3e 100644
+index 0db09da706..813b907db3 100644
 --- a/jdk/src/share/classes/java/security/Security.java
 +++ b/jdk/src/share/classes/java/security/Security.java
@@ -30,6 +30,8 @@ import java.util.*;
@ -640,7 +587,7 @@ index 0db09da7061..813b907db3e 100644
     /*
 diff --git a/jdk/src/share/classes/java/security/SystemConfigurator.java b/jdk/src/share/classes/java/security/SystemConfigurator.java
 new file mode 100644
-index 00000000000..a24a0445db2
+index 0000000000..a24a0445db
 --- /dev/null
 +++ b/jdk/src/share/classes/java/security/SystemConfigurator.java
@@ -0,0 +1,248 @@
@ -894,7 +841,7 @@ index 00000000000..a24a0445db2
 +}
 diff --git a/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java b/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
 new file mode 100644
-index 00000000000..5c30a8b29c7
+index 0000000000..5c30a8b29c
 --- /dev/null
 +++ b/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
@@ -0,0 +1,31 @@
@ -930,7 +877,7 @@ index 00000000000..5c30a8b29c7
 +    boolean isPlainKeySupportEnabled();
 +}
 diff --git a/jdk/src/share/classes/sun/misc/SharedSecrets.java b/jdk/src/share/classes/sun/misc/SharedSecrets.java
-index f065a2c685d..0dafe6f59cf 100644
+index f065a2c685..0dafe6f59c 100644
 --- a/jdk/src/share/classes/sun/misc/SharedSecrets.java
 +++ b/jdk/src/share/classes/sun/misc/SharedSecrets.java
@@ -31,6 +31,7 @@ import java.io.Console;
@ -967,7 +914,7 @@ index f065a2c685d..0dafe6f59cf 100644
 }
 diff --git a/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java b/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
 new file mode 100644
-index 00000000000..14d19450390
+index 0000000000..14d1945039
 --- /dev/null
 +++ b/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
@@ -0,0 +1,290 @@
@ -1262,7 +1209,7 @@ index 00000000000..14d19450390
 +    }
 +}
 diff --git a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
-index fedcd7743ef..f9d70863bd1 100644
+index fedcd7743e..f9d70863bd 100644
 --- a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
@@ -26,6 +26,9 @@
@ -1366,7 +1313,7 @@ index fedcd7743ef..f9d70863bd1 100644
             if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
                 throw new UnsupportedOperationException
 diff --git a/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 2e42d1d9fb0..1b7eed1c656 100644
+index 2e42d1d9fb..1b7eed1c65 100644
 --- a/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
@@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper;
@ -1493,7 +1440,7 @@ index 2e42d1d9fb0..1b7eed1c656 100644
 +}
 }
 diff --git a/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java b/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
-index ffee2c1603b..98119479823 100644
+index ffee2c1603..9811947982 100644
 --- a/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
 +++ b/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
@@ -33,8 +33,13 @@ import java.security.KeyStore.*;
@ -1532,7 +1479,7 @@ index ffee2c1603b..98119479823 100644
                         "FIPS mode: KeyStore must be " +
                         "from provider " + SunJSSE.cryptoProvider.getName());
 diff --git a/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java b/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
-index 820e10164fc..6fe2c29389f 100644
+index 820e10164f..6fe2c29389 100644
 --- a/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
 +++ b/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
@@ -31,6 +31,7 @@ import java.security.*;
@ -1630,7 +1577,7 @@ index 820e10164fc..6fe2c29389f 100644
                         ProtocolVersion.TLS13,
                         ProtocolVersion.TLS12,
 diff --git a/jdk/src/share/classes/sun/security/ssl/SunJSSE.java b/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
-index 2845dc37938..52337a7b6cf 100644
+index 2845dc3793..52337a7b6c 100644
 --- a/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
 +++ b/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
@@ -30,6 +30,8 @@ import static sun.security.util.SecurityConstants.PROVIDER_VER;
@ -1659,7 +1606,7 @@ index 2845dc37938..52337a7b6cf 100644
             "sun.security.ssl.SSLContextImpl$TLSContext");
         if (isfips == false) {
 diff --git a/jdk/src/share/lib/security/java.security-aix b/jdk/src/share/lib/security/java.security-aix
-index 7a93d4e6b59..681a24b905d 100644
+index 37bca2df46..730212b601 100644
 --- a/jdk/src/share/lib/security/java.security-aix
 +++ b/jdk/src/share/lib/security/java.security-aix
@@ -287,6 +287,13 @@ package.definition=sun.,\
@ -1677,7 +1624,7 @@ index 7a93d4e6b59..681a24b905d 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux
-index 145a84f94cf..789c19a8cba 100644
+index 9bb8e992fb..a1b3943b11 100644
 --- a/jdk/src/share/lib/security/java.security-linux
 +++ b/jdk/src/share/lib/security/java.security-linux
@@ -75,6 +75,14 @@ security.provider.7=com.sun.security.sasl.Provider
@ -1722,7 +1669,7 @@ index 145a84f94cf..789c19a8cba 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-macosx b/jdk/src/share/lib/security/java.security-macosx
-index 35fa140d7a5..d4da666af3b 100644
+index 7a765742e6..5abd95fff8 100644
 --- a/jdk/src/share/lib/security/java.security-macosx
 +++ b/jdk/src/share/lib/security/java.security-macosx
@@ -290,6 +290,13 @@ package.definition=sun.,\
@ -1740,7 +1687,7 @@ index 35fa140d7a5..d4da666af3b 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-solaris b/jdk/src/share/lib/security/java.security-solaris
-index f79ba37ddb9..300132384a1 100644
+index f0100336f5..2f4c6c2fd6 100644
 --- a/jdk/src/share/lib/security/java.security-solaris
 +++ b/jdk/src/share/lib/security/java.security-solaris
@@ -288,6 +288,13 @@ package.definition=sun.,\
@ -1758,7 +1705,7 @@ index f79ba37ddb9..300132384a1 100644
 # Determines the default key and trust manager factory algorithms for
 # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-windows b/jdk/src/share/lib/security/java.security-windows
-index d70503ce95f..64db5a5cd1e 100644
+index e51bdece13..b4a509753b 100644
 --- a/jdk/src/share/lib/security/java.security-windows
 +++ b/jdk/src/share/lib/security/java.security-windows
@@ -290,6 +290,13 @@ package.definition=sun.,\
@ -1777,7 +1724,7 @@ index d70503ce95f..64db5a5cd1e 100644
 # the javax.net.ssl package.
 diff --git a/jdk/src/solaris/native/java/security/systemconf.c b/jdk/src/solaris/native/java/security/systemconf.c
 new file mode 100644
-index 00000000000..8dcb7d9073f
+index 0000000000..8dcb7d9073
 --- /dev/null
 +++ b/jdk/src/solaris/native/java/security/systemconf.c
@@ -0,0 +1,224 @@
--- a/SOURCES/java-1.8.0-openjdk-portable.specfile
+++ b/SOURCES/java-1.8.0-openjdk-portable.specfile
@ -269,7 +269,7 @@
 # Define version of OpenJDK 8 used
 %global project openjdk
 %global repo shenandoah-jdk8u
-%global openjdk_revision 8u422-b05
+%global openjdk_revision 8u452-b09
 %global shenandoah_revision shenandoah%{openjdk_revision}
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      3.15.0
@ -547,8 +547,6 @@ Patch539: pr2888-rh2055274-support_system_cacerts-%{cacertsver}.patch
 Patch541: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
 # RH1750419: Enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
 Patch600: rh1750419-redhat_alt_java.patch
 # JDK-8281098, PR3836: Extra compiler flags not passed to adlc build
 Patch112: jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch
 #############################################
 #
@ -595,6 +593,11 @@ Patch204: jdk8042159-allow_using_system_installed_lcms2-jdk.patch
 Patch581: jdk8257794-remove_broken_assert.patch
 # JDK-8186464, RH1433262: ZipFile cannot read some InfoZip ZIP64 zip files
 Patch12: jdk8186464-rh1433262-zip64_failure.patch
 # JDK-8328999, RH2251025 - Update GIFlib to 5.2.2 (PR#571)
 Patch13: jdk8328999-update_giflib_5.2.2.patch
 # JDK-8141590 - Cannot build Zero with devkit
 Patch14: jdk8141590-bundle_libffi.patch
 Patch15: jdk8141590-bundle_libffi-followup.patch
 #############################################
 #
@ -643,6 +646,8 @@ BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: alsa-lib-devel
 BuildRequires: binutils
 # cacerts build requirement.
 BuildRequires: ca-certificates
 BuildRequires: cups-devel
 BuildRequires: desktop-file-utils
 # elfutils only are OK for build without AOT
@ -650,8 +655,13 @@ BuildRequires: elfutils-devel
 BuildRequires: file
 BuildRequires: fontconfig-devel
 BuildRequires: freetype-devel
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 BuildRequires: gcc-c++
 BuildRequires: gdb
 BuildRequires: make
 # Require a boot JDK which doesn't fail due to RH1482244
 BuildRequires: java-%{buildjdkver}-openjdk-devel >= 1.7.0.151-2.6.11.3
 BuildRequires: libxslt
 BuildRequires: libX11-devel
 BuildRequires: libXext-devel
@ -662,25 +672,17 @@ BuildRequires: libXt-devel
 BuildRequires: libXtst-devel
 # Requirement for setting up nss.cfg and nss.fips.cfg
 BuildRequires: nss-devel
 # Commented out for portable RHEL7 doesn't have this
 # Requirement for system security property test
 #BuildRequires: crypto-policies
 BuildRequires: pkgconfig
 BuildRequires: xorg-x11-proto-devel
 BuildRequires: tar
 BuildRequires: unzip
 BuildRequires: zip
-# Require a boot JDK which doesn't fail due to RH1482244
+
 BuildRequires: java-%{buildjdkver}-openjdk-devel >= 1.7.0.151-2.6.11.3
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 # cacerts build requirement.
 BuildRequires: ca-certificates
 %if %{with_systemtap}
 BuildRequires: systemtap-sdt-devel
 %endif
@ -693,7 +695,7 @@ BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 %else
 # Version in jdk/src/share/native/sun/awt/giflib/gif_lib.h
-Provides: bundled(giflib) = 5.2.1
+Provides: bundled(giflib) = 5.2.2
 # Version in jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
 Provides: bundled(lcms2) = 2.11.0
 # Version in jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
@ -701,7 +703,7 @@ Provides: bundled(libjpeg) = 6b
 # Version in jdk/src/share/native/sun/awt/libpng/png.h
 Provides: bundled(libpng) = 1.6.39
 # Version in jdk/src/share/native/java/util/zip/zlib/zlib.h
-Provides: bundled(zlib) = 1.2.13
+Provides: bundled(zlib) = 1.3.1
 # We link statically against libstdc++ to increase portability
 BuildRequires: libstdc++-static
 %endif
@ -860,7 +862,9 @@ sh %{SOURCE12}
 # AArch64 fixes
 # x86 fixes
-%patch -P105
+pushd %{top_level_dir_name}
 %patch -P105 -p1
 popd
 # Upstreamable fixes
 %patch -P512
@ -868,12 +872,14 @@ sh %{SOURCE12}
 %patch -P528
 %patch -P571
 %patch -P574
 %patch -P112
 %patch -P581
 %patch -P541
 %patch -P12
 pushd %{top_level_dir_name}
 %patch -P502 -p1
 %patch -P13 -p1
 %patch -P14 -p1
 %patch -P15 -p1
 popd
 pushd %{top_level_dir_name}
@ -1003,6 +1009,7 @@ function buildjdk() {
 %endif
 %ifarch %{zero_arches}
    --with-jvm-variants=zero \
    --enable-libffi-bundling \
 %endif
    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
    --with-native-debug-symbols=${debug_symbols} \
@ -1172,10 +1179,12 @@ function packagejdk() {
        # Strip the files
        for file in $(find ${jdkname} ${jrename} -type f) ; do
            if file ${file} | grep -q 'ELF'; then
-                noextfile=${file/.so/};
+                if ! echo ${file} | grep -q 'libffi' ; then
-                objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
+                  noextfile=${file/.so/};
-                objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
+                  objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
-                strip -g ${file};
+                  objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
                  strip -g ${file};
                fi
            fi
        done
@ -1538,6 +1547,49 @@ done
 %endif
 %changelog
 * Fri Apr 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.452.b09-1
 - Update to 8u452-b09 (GA)
 - Update release notes for 8u452-b09.
 - Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u
 - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
 * Thu Jan 16 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-1
 - Update to 8u442-b06 (GA)
 - Update release notes for 8u442-b06.
 - Switch to GA mode for final release
 - Revise JDK-8141590 backport to install libffi.so* in lib as well as jre/lib
 * Thu Jan 16 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.2.ea
 - Include backport of JDK-8141590 to allow bundling of libffi on Zero architectures
 - Rebase FIPS patch after application of 8141590
 - Add local patch on top of 8141590 to improve path detection for s390x
 - Don't attempt to strip libffi.so*
 * Mon Jan 06 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.1.ea
 - Update to 8u442-b05 (EA).
 - Update release notes for 8u442-b05.
 - Switch to EA mode for pre-release.
 * Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-1
 - Update to shenandoah-jdk8u432-b06 (GA)
 - Update release notes for shenandoah-8u432-b06.
 - Switch to GA mode.
 - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
 * Thu Oct 10 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b05-0.1.ea
 - Update to shenandoah-jdk8u432-b05 (EA)
 - Update release notes for shenandoah-8u432-b05.
 - Switch to EA mode.
 - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version
 - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
 - Bump version of bundled zlib to 1.3.1 following JDK-8324632
 - Add build dependency on make
 - Reorganise build dependencies to retain alphabetical order for unconditional deps
 - Include backport of JDK-8328999 to update giflib to 5.2.2
 - Bump version of bundled giflib to 5.2.2 following JDK-8328999
 - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
 - Resolves: OPENJDK-3348
 * Wed Jul 10 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
 - Update to shenandoah-jdk8u422-b05 (GA)
 - Update release notes for shenandoah-8u422-b05.
--- a/SOURCES/jdk8141590-bundle_libffi-followup.patch
+++ b/SOURCES/jdk8141590-bundle_libffi-followup.patch
@ -0,0 +1,51 @@
 commit 928f3bf4a3017931ecc7012688e62d8a03264e61
 Author:     Andrew Hughes <gnu.andrew@redhat.com>
 AuthorDate: Thu Jan 16 17:40:36 2025 +0000
 Commit:     Andrew Hughes <gnu.andrew@redhat.com>
 CommitDate: Thu Jan 16 22:50:24 2025 +0000
    Search /usr/lib64 on architectures other than x86_64
 diff --git a/common/autoconf/generated-configure.sh b/common/autoconf/generated-configure.sh
 index 587b4c2657..5aeebe49a3 100644
 --- a/common/autoconf/generated-configure.sh
 +++ b/common/autoconf/generated-configure.sh
@@ -4493,7 +4493,7 @@ VS_TOOLSET_SUPPORTED_2022=true
 #CUSTOM_AUTOCONF_INCLUDE
 # Do not change or remove the following line, it is needed for consistency checks:
 -DATE_WHEN_GENERATED=1737049912
 +DATE_WHEN_GENERATED=1737067804
 ###############################################################################
 #
@@ -50590,9 +50590,11 @@ $as_echo_n "checking for libffi lib file location... " >&6; }
             as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
           fi
         else
 -          # Fallback on the default /usr/lib dir
 +          # Fallback on the default /usr/lib and /usr/lib64 dirs
           if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
             LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
 +          elif test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
           else
             as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
           fi
 diff --git a/common/autoconf/libraries.m4 b/common/autoconf/libraries.m4
 index 4ed8b4fdd6..6ab6dbc075 100644
 --- a/common/autoconf/libraries.m4
 +++ b/common/autoconf/libraries.m4
@@ -1121,9 +1121,11 @@ AC_DEFUN_ONCE([LIB_SETUP_STATIC_LINK_LIBSTDCPP],
             AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
           fi
         else
 -          # Fallback on the default /usr/lib dir
 +          # Fallback on the default /usr/lib and /usr/lib64 dirs
           if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
             LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
 +          elif test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
           else
             AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
           fi
--- a/SOURCES/jdk8141590-bundle_libffi.patch
+++ b/SOURCES/jdk8141590-bundle_libffi.patch
@ -0,0 +1,763 @@
 diff --git a/common/autoconf/generated-configure.sh b/common/autoconf/generated-configure.sh
 index ad3f7f232e..587b4c2657 100644
 --- a/common/autoconf/generated-configure.sh
 +++ b/common/autoconf/generated-configure.sh
@@ -649,6 +649,9 @@ LLVM_LIBS
 LLVM_LDFLAGS
 LLVM_CFLAGS
 LLVM_CONFIG
 +LIBFFI_LIB_FILE
 +LIBFFI_LIB_DIR
 +ENABLE_LIBFFI_BUNDLING
 LIBFFI_LIBS
 LIBFFI_CFLAGS
 STATIC_CXX_SETTING
@@ -1117,6 +1120,10 @@ with_fontconfig_include
 with_giflib
 with_zlib
 with_stdc__lib
 +with_libffi
 +with_libffi_include
 +with_libffi_lib
 +enable_libffi_bundling
 with_msvcr_dll
 with_msvcp_dll
 with_vcruntime_1_dll
@@ -1867,6 +1874,9 @@ Optional Features:
                           disable bundling of the freetype library with the
                           build result [enabled on Windows or when using
                           --with-freetype, disabled otherwise]
 +  --enable-libffi-bundling
 +                          enable bundling of libffi.so to make the built JDK
 +                          runnable on more systems
   --enable-sjavac         use sjavac to do fast incremental compiles
                           [disabled]
   --disable-precompiled-headers
@@ -1996,6 +2006,11 @@ Optional Packages:
                           force linking of the C++ runtime on Linux to either
                           static or dynamic, default is static with dynamic as
                           fallback
 +  --with-libffi           specify prefix directory for the libffi package
 +                          (expecting the libraries under PATH/lib and the
 +                          headers under PATH/include)
 +  --with-libffi-include   specify directory for the libffi include files
 +  --with-libffi-lib       specify directory for the libffi library
   --with-msvcr-dll        path to microsoft C runtime dll (msvcr*.dll)
                           (Windows only) [probed]
   --with-msvcp-dll        path to microsoft C++ runtime dll (msvcp*.dll)
@@ -2878,6 +2893,52 @@ $as_echo "$ac_res" >&6; }
   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 } # ac_fn_c_check_header_compile
 +
 +# ac_fn_c_try_link LINENO
 +# -----------------------
 +# Try to link conftest.$ac_ext, and return whether this succeeded.
 +ac_fn_c_try_link ()
 +{
 +  as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
 +  rm -f conftest.$ac_objext conftest$ac_exeext
 +  if { { ac_try="$ac_link"
 +case "(($ac_try" in
 +  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
 +  *) ac_try_echo=$ac_try;;
 +esac
 +eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
 +$as_echo "$ac_try_echo"; } >&5
 +  (eval "$ac_link") 2>conftest.err
 +  ac_status=$?
 +  if test -s conftest.err; then
 +    grep -v '^ *+' conftest.err >conftest.er1
 +    cat conftest.er1 >&5
 +    mv -f conftest.er1 conftest.err
 +  fi
 +  $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
 +  test $ac_status = 0; } && {
 +	 test -z "$ac_c_werror_flag" ||
 +	 test ! -s conftest.err
 +       } && test -s conftest$ac_exeext && {
 +	 test "$cross_compiling" = yes ||
 +	 test -x conftest$ac_exeext
 +       }; then :
 +  ac_retval=0
 +else
 +  $as_echo "$as_me: failed program was:" >&5
 +sed 's/^/| /' conftest.$ac_ext >&5
 +
 +	ac_retval=1
 +fi
 +  # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
 +  # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
 +  # interfere with the next link command; also delete a directory that is
 +  # left behind by Apple's compiler.  We do this before executing the actions.
 +  rm -rf conftest.dSYM conftest_ipa8_conftest.oo
 +  eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
 +  as_fn_set_status $ac_retval
 +
 +} # ac_fn_c_try_link
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
@@ -4432,7 +4493,7 @@ VS_TOOLSET_SUPPORTED_2022=true
 #CUSTOM_AUTOCONF_INCLUDE
 # Do not change or remove the following line, it is needed for consistency checks:
 -DATE_WHEN_GENERATED=1716396030
 +DATE_WHEN_GENERATED=1737049912
 ###############################################################################
 #
@@ -50215,8 +50276,70 @@ $as_echo "static" >&6; }
   fi
 +
 +# Check whether --with-libffi was given.
 +if test "${with_libffi+set}" = set; then :
 +  withval=$with_libffi;
 +fi
 +
 +
 +# Check whether --with-libffi-include was given.
 +if test "${with_libffi_include+set}" = set; then :
 +  withval=$with_libffi_include;
 +fi
 +
 +
 +# Check whether --with-libffi-lib was given.
 +if test "${with_libffi_lib+set}" = set; then :
 +  withval=$with_libffi_lib;
 +fi
 +
 +  # Check whether --enable-libffi-bundling was given.
 +if test "${enable_libffi_bundling+set}" = set; then :
 +  enableval=$enable_libffi_bundling;
 +fi
 +
 +
 +  # Check if ffi is needed
   if test "x$JVM_VARIANT_ZERO" = xtrue || test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
 -    # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
 +    NEEDS_LIB_FFI=true
 +  else
 +    NEEDS_LIB_FFI=false
 +  fi
 +
 +  if test "x$NEEDS_LIB_FFI" = xfalse; then
 +    if test "x${with_libffi}" != x || test "x${with_libffi_include}" != x || test "x${with_libffi_lib}" != x; then
 +      { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: libffi not used, so --with-libffi is ignored" >&5
 +$as_echo "$as_me: WARNING: libffi not used, so --with-libffi is ignored" >&2;}
 +    fi
 +    LIBFFI_CFLAGS=
 +    LIBFFI_LIBS=
 +  else
 +    LIBFFI_FOUND=no
 +
 +    if test "x${with_libffi}" = xno || test "x${with_libffi_include}" = xno || test "x${with_libffi_lib}" = xno; then
 +      as_fn_error $? "It is not possible to disable the use of libffi. Remove the --without-libffi option." "$LINENO" 5
 +    fi
 +
 +    if test "x${with_libffi}" != x; then
 +      LIBFFI_LIB_PATH="${with_libffi}/lib"
 +      LIBFFI_LIBS="-L${with_libffi}/lib -lffi"
 +      LIBFFI_CFLAGS="-I${with_libffi}/include"
 +      LIBFFI_FOUND=yes
 +    fi
 +    if test "x${with_libffi_include}" != x; then
 +      LIBFFI_CFLAGS="-I${with_libffi_include}"
 +      LIBFFI_FOUND=yes
 +    fi
 +    if test "x${with_libffi_lib}" != x; then
 +      LIBFFI_LIB_PATH="${with_libffi_lib}"
 +      LIBFFI_LIBS="-L${with_libffi_lib} -lffi"
 +      LIBFFI_FOUND=yes
 +    fi
 +    # Do not try pkg-config if we have a sysroot set.
 +    if test "x$SYSROOT" = x; then
 +      if test "x$LIBFFI_FOUND" = xno; then
 +        # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
 pkg_failed=no
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for LIBFFI" >&5
@@ -50272,40 +50395,224 @@ fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$LIBFFI_PKG_ERRORS" >&5
 -	as_fn_error $? "Package requirements (libffi) were not met:
 -
 -$LIBFFI_PKG_ERRORS
 -
 -Consider adjusting the PKG_CONFIG_PATH environment variable if you
 -installed software in a non-standard prefix.
 -
 -Alternatively, you may set the environment variables LIBFFI_CFLAGS
 -and LIBFFI_LIBS to avoid the need to call pkg-config.
 -See the pkg-config man page for more details.
 -" "$LINENO" 5
 +	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 +$as_echo "no" >&6; }
 +                LIBFFI_FOUND=no
 elif test $pkg_failed = untried; then
 -	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 -$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
 -as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
 -is in your PATH or set the PKG_CONFIG environment variable to the full
 -path to pkg-config.
 -
 -Alternatively, you may set the environment variables LIBFFI_CFLAGS
 -and LIBFFI_LIBS to avoid the need to call pkg-config.
 -See the pkg-config man page for more details.
 -
 -To get pkg-config, see <http://pkg-config.freedesktop.org/>.
 -See \`config.log' for more details" "$LINENO" 5; }
 +	LIBFFI_FOUND=no
 else
 	LIBFFI_CFLAGS=$pkg_cv_LIBFFI_CFLAGS
 	LIBFFI_LIBS=$pkg_cv_LIBFFI_LIBS
         { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
 -	:
 +	LIBFFI_FOUND=yes
 +fi
 +      fi
 +    fi
 +    if test "x$LIBFFI_FOUND" = xno; then
 +      for ac_header in ffi.h
 +do :
 +  ac_fn_cxx_check_header_mongrel "$LINENO" "ffi.h" "ac_cv_header_ffi_h" "$ac_includes_default"
 +if test "x$ac_cv_header_ffi_h" = xyes; then :
 +  cat >>confdefs.h <<_ACEOF
 +#define HAVE_FFI_H 1
 +_ACEOF
 +
 +            LIBFFI_FOUND=yes
 +            LIBFFI_CFLAGS=
 +            LIBFFI_LIBS=-lffi
 +
 +else
 +  LIBFFI_FOUND=no
 +
 +fi
 +
 +done
 +
 +    fi
 +    if test "x$LIBFFI_FOUND" = xno; then
 +
 +  # Print a helpful message on how to acquire the necessary build dependency.
 +  # ffi is the help tag: freetype, cups, pulse, alsa etc
 +  MISSING_DEPENDENCY=ffi
 +
 +  if test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.cygwin"; then
 +    cygwin_help $MISSING_DEPENDENCY
 +  elif test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.msys"; then
 +    msys_help $MISSING_DEPENDENCY
 +  else
 +    PKGHANDLER_COMMAND=
 +
 +    case $PKGHANDLER in
 +      apt-get)
 +        apt_help     $MISSING_DEPENDENCY ;;
 +      yum)
 +        yum_help     $MISSING_DEPENDENCY ;;
 +      port)
 +        port_help    $MISSING_DEPENDENCY ;;
 +      pkgutil)
 +        pkgutil_help $MISSING_DEPENDENCY ;;
 +      pkgadd)
 +        pkgadd_help  $MISSING_DEPENDENCY ;;
 +    esac
 +
 +    if test "x$PKGHANDLER_COMMAND" != x; then
 +      HELP_MSG="You might be able to fix this by running '$PKGHANDLER_COMMAND'."
 +    fi
 +  fi
 +
 +      as_fn_error $? "Could not find libffi! $HELP_MSG" "$LINENO" 5
 +    fi
 +
 +    { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libffi works" >&5
 +$as_echo_n "checking if libffi works... " >&6; }
 +    ac_ext=c
 +ac_cpp='$CPP $CPPFLAGS'
 +ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5'
 +ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
 +ac_compiler_gnu=$ac_cv_c_compiler_gnu
 +
 +    OLD_CFLAGS="$CFLAGS"
 +    CFLAGS="$CFLAGS $LIBFFI_CFLAGS"
 +    OLD_LIBS="$LIBS"
 +    LIBS="$LIBS $LIBFFI_LIBS"
 +    cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 +/* end confdefs.h.  */
 +#include <ffi.h>
 +int
 +main (void)
 +{
 +
 +          ffi_call(NULL, NULL, NULL, NULL);
 +          return 0;
 +
 +  ;
 +  return 0;
 +}
 +_ACEOF
 +if ac_fn_c_try_link "$LINENO"; then :
 +  LIBFFI_WORKS=yes
 +else
 +  LIBFFI_WORKS=no
 +
 fi
 +rm -f core conftest.err conftest.$ac_objext \
 +    conftest$ac_exeext conftest.$ac_ext
 +    CFLAGS="$OLD_CFLAGS"
 +    LIBS="$OLD_LIBS"
 +    ac_ext=cpp
 +ac_cpp='$CXXCPP $CPPFLAGS'
 +ac_compile='$CXX -c $CXXFLAGS $CPPFLAGS conftest.$ac_ext >&5'
 +ac_link='$CXX -o conftest$ac_exeext $CXXFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5'
 +ac_compiler_gnu=$ac_cv_cxx_compiler_gnu
 +
 +    { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LIBFFI_WORKS" >&5
 +$as_echo "$LIBFFI_WORKS" >&6; }
 +    if test "x$LIBFFI_WORKS" = xno; then
 +
 +  # Print a helpful message on how to acquire the necessary build dependency.
 +  # ffi is the help tag: freetype, cups, pulse, alsa etc
 +  MISSING_DEPENDENCY=ffi
 +
 +  if test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.cygwin"; then
 +    cygwin_help $MISSING_DEPENDENCY
 +  elif test "x$OPENJDK_BUILD_OS_ENV" = "xwindows.msys"; then
 +    msys_help $MISSING_DEPENDENCY
 +  else
 +    PKGHANDLER_COMMAND=
 +
 +    case $PKGHANDLER in
 +      apt-get)
 +        apt_help     $MISSING_DEPENDENCY ;;
 +      yum)
 +        yum_help     $MISSING_DEPENDENCY ;;
 +      port)
 +        port_help    $MISSING_DEPENDENCY ;;
 +      pkgutil)
 +        pkgutil_help $MISSING_DEPENDENCY ;;
 +      pkgadd)
 +        pkgadd_help  $MISSING_DEPENDENCY ;;
 +    esac
 +
 +    if test "x$PKGHANDLER_COMMAND" != x; then
 +      HELP_MSG="You might be able to fix this by running '$PKGHANDLER_COMMAND'."
 +    fi
   fi
 +      as_fn_error $? "Found libffi but could not link and compile with it. $HELP_MSG" "$LINENO" 5
 +    fi
 +
 +    { $as_echo "$as_me:${as_lineno-$LINENO}: checking if libffi should be bundled" >&5
 +$as_echo_n "checking if libffi should be bundled... " >&6; }
 +    if test "x$enable_libffi_bundling" = "x"; then
 +      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 +$as_echo "no" >&6; }
 +      ENABLE_LIBFFI_BUNDLING=false
 +    elif  test "x$enable_libffi_bundling" = "xno"; then
 +      { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, forced" >&5
 +$as_echo "no, forced" >&6; }
 +      ENABLE_LIBFFI_BUNDLING=false
 +    elif  test "x$enable_libffi_bundling" = "xyes"; then
 +      { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes, forced" >&5
 +$as_echo "yes, forced" >&6; }
 +      ENABLE_LIBFFI_BUNDLING=true
 +    else
 +      as_fn_error $? "Invalid value for --enable-libffi-bundling" "$LINENO" 5
 +    fi
 +
 +    # Find the libffi.so.X to bundle
 +    if test "x${ENABLE_LIBFFI_BUNDLING}" = "xtrue"; then
 +      { $as_echo "$as_me:${as_lineno-$LINENO}: checking for libffi lib file location" >&5
 +$as_echo_n "checking for libffi lib file location... " >&6; }
 +      if test "x${LIBFFI_LIB_PATH}" != x; then
 +        if test -e ${LIBFFI_LIB_PATH}/libffi.so.?; then
 +          LIBFFI_LIB_FILE="${LIBFFI_LIB_PATH}/libffi.so.?"
 +        else
 +          as_fn_error $? "Could not locate libffi.so.? for bundling in ${LIBFFI_LIB_PATH}" "$LINENO" 5
 +        fi
 +      else
 +        # If we don't have an explicit path, look in a few obvious places
 +        if test "x${OPENJDK_TARGET_CPU}" = "xx86"; then
 +          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
 +          elif test -e ${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.?"
 +          else
 +            as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
 +          fi
 +        elif test "x${OPENJDK_TARGET_CPU}" = "xx86_64"; then
 +          if test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
 +          elif test -e ${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.?"
 +          else
 +            as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
 +          fi
 +        else
 +          # Fallback on the default /usr/lib dir
 +          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
 +          else
 +            as_fn_error $? "Could not locate libffi.so.? for bundling" "$LINENO" 5
 +          fi
 +        fi
 +      fi
 +      # Make sure the wildcard is evaluated
 +      LIBFFI_LIB_FILE="$(ls ${LIBFFI_LIB_FILE})"
 +      LIBFFI_LIB_DIR="$(dirname ${LIBFFI_LIB_FILE})"
 +      LIBFFI_LIB_FILE="$(basename ${LIBFFI_LIB_FILE})"
 +      { $as_echo "$as_me:${as_lineno-$LINENO}: result: ${LIBFFI_LIB_FILE} in ${LIBFFI_LIB_DIR}" >&5
 +$as_echo "${LIBFFI_LIB_FILE} in ${LIBFFI_LIB_DIR}" >&6; }
 +    fi
 +  fi
 +
 +
 +
 +
 +
 +
 +
   if test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
     # Extract the first word of "llvm-config", so it can be a program name with args.
 set dummy llvm-config; ac_word=$2
 diff --git a/common/autoconf/libraries.m4 b/common/autoconf/libraries.m4
 index 6efae578ea..4ed8b4fdd6 100644
 --- a/common/autoconf/libraries.m4
 +++ b/common/autoconf/libraries.m4
@@ -988,12 +988,161 @@ AC_DEFUN_ONCE([LIB_SETUP_STATIC_LINK_LIBSTDCPP],
   fi
   AC_SUBST(STATIC_CXX_SETTING)
 +  AC_ARG_WITH(libffi, [AS_HELP_STRING([--with-libffi],
 +      [specify prefix directory for the libffi package
 +      (expecting the libraries under PATH/lib and the headers under PATH/include)])])
 +  AC_ARG_WITH(libffi-include, [AS_HELP_STRING([--with-libffi-include],
 +      [specify directory for the libffi include files])])
 +  AC_ARG_WITH(libffi-lib, [AS_HELP_STRING([--with-libffi-lib],
 +      [specify directory for the libffi library])])
 +  AC_ARG_ENABLE(libffi-bundling, [AS_HELP_STRING([--enable-libffi-bundling],
 +      [enable bundling of libffi.so to make the built JDK runnable on more systems])])
 +
 +  # Check if ffi is needed
   if test "x$JVM_VARIANT_ZERO" = xtrue || test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
 -    # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
 -    PKG_CHECK_MODULES([LIBFFI], [libffi])
 +    NEEDS_LIB_FFI=true
 +  else
 +    NEEDS_LIB_FFI=false
 +  fi
 +
 +  if test "x$NEEDS_LIB_FFI" = xfalse; then
 +    if test "x${with_libffi}" != x || test "x${with_libffi_include}" != x || test "x${with_libffi_lib}" != x; then
 +      AC_MSG_WARN([libffi not used, so --with-libffi is ignored])
 +    fi
 +    LIBFFI_CFLAGS=
 +    LIBFFI_LIBS=
 +  else
 +    LIBFFI_FOUND=no
 +    if test "x${with_libffi}" = xno || test "x${with_libffi_include}" = xno || test "x${with_libffi_lib}" = xno; then
 +      AC_MSG_ERROR([It is not possible to disable the use of libffi. Remove the --without-libffi option.])
 +    fi
 +
 +    if test "x${with_libffi}" != x; then
 +      LIBFFI_LIB_PATH="${with_libffi}/lib"
 +      LIBFFI_LIBS="-L${with_libffi}/lib -lffi"
 +      LIBFFI_CFLAGS="-I${with_libffi}/include"
 +      LIBFFI_FOUND=yes
 +    fi
 +    if test "x${with_libffi_include}" != x; then
 +      LIBFFI_CFLAGS="-I${with_libffi_include}"
 +      LIBFFI_FOUND=yes
 +    fi
 +    if test "x${with_libffi_lib}" != x; then
 +      LIBFFI_LIB_PATH="${with_libffi_lib}"
 +      LIBFFI_LIBS="-L${with_libffi_lib} -lffi"
 +      LIBFFI_FOUND=yes
 +    fi
 +    # Do not try pkg-config if we have a sysroot set.
 +    if test "x$SYSROOT" = x; then
 +      if test "x$LIBFFI_FOUND" = xno; then
 +        # Figure out LIBFFI_CFLAGS and LIBFFI_LIBS
 +        PKG_CHECK_MODULES([LIBFFI], [libffi], [LIBFFI_FOUND=yes], [LIBFFI_FOUND=no])
 +      fi
 +    fi
 +    if test "x$LIBFFI_FOUND" = xno; then
 +      AC_CHECK_HEADERS([ffi.h],
 +          [
 +            LIBFFI_FOUND=yes
 +            LIBFFI_CFLAGS=
 +            LIBFFI_LIBS=-lffi
 +          ],
 +          [LIBFFI_FOUND=no]
 +      )
 +    fi
 +    if test "x$LIBFFI_FOUND" = xno; then
 +      HELP_MSG_MISSING_DEPENDENCY([ffi])
 +      AC_MSG_ERROR([Could not find libffi! $HELP_MSG])
 +    fi
 +
 +    AC_MSG_CHECKING([if libffi works])
 +    AC_LANG_PUSH(C)
 +    OLD_CFLAGS="$CFLAGS"
 +    CFLAGS="$CFLAGS $LIBFFI_CFLAGS"
 +    OLD_LIBS="$LIBS"
 +    LIBS="$LIBS $LIBFFI_LIBS"
 +    AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <ffi.h>],
 +        [
 +          ffi_call(NULL, NULL, NULL, NULL);
 +          return 0;
 +        ])],
 +        [LIBFFI_WORKS=yes],
 +        [LIBFFI_WORKS=no]
 +    )
 +    CFLAGS="$OLD_CFLAGS"
 +    LIBS="$OLD_LIBS"
 +    AC_LANG_POP(C)
 +    AC_MSG_RESULT([$LIBFFI_WORKS])
 +
 +    if test "x$LIBFFI_WORKS" = xno; then
 +      HELP_MSG_MISSING_DEPENDENCY([ffi])
 +      AC_MSG_ERROR([Found libffi but could not link and compile with it. $HELP_MSG])
 +    fi
 +
 +    AC_MSG_CHECKING([if libffi should be bundled])
 +    if test "x$enable_libffi_bundling" = "x"; then
 +      AC_MSG_RESULT([no])
 +      ENABLE_LIBFFI_BUNDLING=false
 +    elif  test "x$enable_libffi_bundling" = "xno"; then
 +      AC_MSG_RESULT([no, forced])
 +      ENABLE_LIBFFI_BUNDLING=false
 +    elif  test "x$enable_libffi_bundling" = "xyes"; then
 +      AC_MSG_RESULT([yes, forced])
 +      ENABLE_LIBFFI_BUNDLING=true
 +    else
 +      AC_MSG_ERROR([Invalid value for --enable-libffi-bundling])
 +    fi
 +
 +    # Find the libffi.so.X to bundle
 +    if test "x${ENABLE_LIBFFI_BUNDLING}" = "xtrue"; then
 +      AC_MSG_CHECKING([for libffi lib file location])
 +      if test "x${LIBFFI_LIB_PATH}" != x; then
 +        if test -e ${LIBFFI_LIB_PATH}/libffi.so.?; then
 +          LIBFFI_LIB_FILE="${LIBFFI_LIB_PATH}/libffi.so.?"
 +        else
 +          AC_MSG_ERROR([Could not locate libffi.so.? for bundling in ${LIBFFI_LIB_PATH}])
 +        fi
 +      else
 +        # If we don't have an explicit path, look in a few obvious places
 +        if test "x${OPENJDK_TARGET_CPU}" = "xx86"; then
 +          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
 +          elif test -e ${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/i386-linux-gnu/libffi.so.?"
 +          else
 +            AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
 +          fi
 +        elif test "x${OPENJDK_TARGET_CPU}" = "xx86_64"; then
 +          if test -e ${SYSROOT}/usr/lib64/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib64/libffi.so.?"
 +          elif test -e ${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/x86_64-linux-gnu/libffi.so.?"
 +          else
 +            AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
 +          fi
 +        else
 +          # Fallback on the default /usr/lib dir
 +          if test -e ${SYSROOT}/usr/lib/libffi.so.? ; then
 +            LIBFFI_LIB_FILE="${SYSROOT}/usr/lib/libffi.so.?"
 +          else
 +            AC_MSG_ERROR([Could not locate libffi.so.? for bundling])
 +          fi
 +        fi
 +      fi
 +      # Make sure the wildcard is evaluated
 +      LIBFFI_LIB_FILE="$(ls ${LIBFFI_LIB_FILE})"
 +      LIBFFI_LIB_DIR="$(dirname ${LIBFFI_LIB_FILE})"
 +      LIBFFI_LIB_FILE="$(basename ${LIBFFI_LIB_FILE})"
 +      AC_MSG_RESULT([${LIBFFI_LIB_FILE} in ${LIBFFI_LIB_DIR}])
 +    fi
   fi
 +  AC_SUBST(LIBFFI_CFLAGS)
 +  AC_SUBST(LIBFFI_LIBS)
 +  AC_SUBST(ENABLE_LIBFFI_BUNDLING)
 +  AC_SUBST(LIBFFI_LIB_DIR)
 +  AC_SUBST(LIBFFI_LIB_FILE)
 +
   if test "x$JVM_VARIANT_ZEROSHARK" = xtrue; then
     AC_CHECK_PROG([LLVM_CONFIG], [llvm-config], [llvm-config])
 diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
 index 9573bb2cbd..8da3ac32a0 100644
 --- a/common/autoconf/spec.gmk.in
 +++ b/common/autoconf/spec.gmk.in
@@ -311,6 +311,11 @@ FONTCONFIG_CFLAGS:=@FONTCONFIG_CFLAGS@
 CUPS_CFLAGS:=@CUPS_CFLAGS@
 ALSA_LIBS:=@ALSA_LIBS@
 ALSA_CFLAGS:=@ALSA_CFLAGS@
 +LIBFFI_LIBS:=@LIBFFI_LIBS@
 +LIBFFI_CFLAGS:=@LIBFFI_CFLAGS@
 +ENABLE_LIBFFI_BUNDLING:=@ENABLE_LIBFFI_BUNDLING@
 +LIBFFI_LIB_DIR:=@LIBFFI_LIB_DIR@
 +LIBFFI_LIB_FILE:=@LIBFFI_LIB_FILE@
 PACKAGE_PATH=@PACKAGE_PATH@
 diff --git a/hotspot/make/Makefile b/hotspot/make/Makefile
 index ad195763be..b9114cb99a 100644
 --- a/hotspot/make/Makefile
 +++ b/hotspot/make/Makefile
@@ -476,6 +476,8 @@ $(EXPORT_INCLUDE_DIR)/%:			$(ZERO_BUILD_DIR)/../generated/jvmtifiles/%
 # Unix
 $(EXPORT_JRE_LIB_ARCH_DIR)/%.$(LIBRARY_SUFFIX): $(ZERO_BUILD_DIR)/%.$(LIBRARY_SUFFIX)
 	$(install-file)
 +$(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE):  $(LIBFFI_LIB_DIR)/$(LIBFFI_LIB_FILE)
 +	$(install-file)
 $(EXPORT_JRE_LIB_ARCH_DIR)/%.debuginfo:		$(ZERO_BUILD_DIR)/%.debuginfo
 	$(install-file)
 $(EXPORT_JRE_LIB_ARCH_DIR)/%.diz:		$(ZERO_BUILD_DIR)/%.diz
 diff --git a/hotspot/make/aix/makefiles/defs.make b/hotspot/make/aix/makefiles/defs.make
 index b12c9c8df2..db10f6a68f 100644
 --- a/hotspot/make/aix/makefiles/defs.make
 +++ b/hotspot/make/aix/makefiles/defs.make
@@ -220,4 +220,7 @@ ADD_SA_BINARIES/zero  =
 EXPORT_LIST += $(ADD_SA_BINARIES/$(HS_ARCH))
 +ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
 +  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
 +endif
 diff --git a/hotspot/make/bsd/makefiles/defs.make b/hotspot/make/bsd/makefiles/defs.make
 index 7cd21cc175..23436f12d8 100644
 --- a/hotspot/make/bsd/makefiles/defs.make
 +++ b/hotspot/make/bsd/makefiles/defs.make
@@ -364,6 +364,10 @@ ADD_SA_BINARIES/zero  =
 EXPORT_LIST += $(ADD_SA_BINARIES/$(HS_ARCH))
 +ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
 +  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
 +endif
 +
 # Universal build settings
 ifeq ($(OS_VENDOR), Darwin)
   # Build universal binaries by default on Mac OS X
 diff --git a/hotspot/make/linux/makefiles/defs.make b/hotspot/make/linux/makefiles/defs.make
 index ec414639d2..0baa4f068d 100644
 --- a/hotspot/make/linux/makefiles/defs.make
 +++ b/hotspot/make/linux/makefiles/defs.make
@@ -333,4 +333,6 @@ ADD_SA_BINARIES/zero  =
 EXPORT_LIST += $(ADD_SA_BINARIES/$(HS_ARCH))
 -
 +ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
 +  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
 +endif
 diff --git a/hotspot/make/solaris/makefiles/defs.make b/hotspot/make/solaris/makefiles/defs.make
 index c88351c82b..cb838e854d 100644
 --- a/hotspot/make/solaris/makefiles/defs.make
 +++ b/hotspot/make/solaris/makefiles/defs.make
@@ -304,3 +304,7 @@ ifeq ($(ENABLE_FULL_DEBUG_SYMBOLS),1)
   endif
 endif
 EXPORT_LIST += $(EXPORT_LIB_DIR)/sa-jdi.jar
 +
 +ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
 +  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
 +endif
 diff --git a/hotspot/make/windows/makefiles/defs.make b/hotspot/make/windows/makefiles/defs.make
 index 6b36f0e2bc..6f42c7ad37 100644
 --- a/hotspot/make/windows/makefiles/defs.make
 +++ b/hotspot/make/windows/makefiles/defs.make
@@ -300,6 +300,10 @@ ifeq ($(BUILD_WIN_SA), 1)
   MAKE_ARGS += BUILD_WIN_SA=1
 endif
 +ifeq ($(ENABLE_LIBFFI_BUNDLING), true)
 +  EXPORT_LIST += $(EXPORT_JRE_LIB_ARCH_DIR)/$(LIBFFI_LIB_FILE)
 +endif
 +
 # Propagate compiler and tools paths from configure to nmake.
 # Need to make sure they contain \\ and not /.
 ifneq ($(SPEC),)
 diff --git a/jdk/make/Images.gmk b/jdk/make/Images.gmk
 index 2e378c9134..0edefd7b5c 100644
 --- a/jdk/make/Images.gmk
 +++ b/jdk/make/Images.gmk
@@ -249,7 +249,8 @@ endif
 ifneq ($(findstring $(OPENJDK_TARGET_OS), linux solaris),) # If Linux or Solaris
     JDK_LIB_FILES += $(LIBRARY_PREFIX)jli$(SHARED_LIBRARY_SUFFIX) \
 -		     $(LIBRARY_PREFIX)jawt$(SHARED_LIBRARY_SUFFIX)
 +		     $(LIBRARY_PREFIX)jawt$(SHARED_LIBRARY_SUFFIX) \
 +		     $(LIBFFI_LIB_FILE)
 endif
 # Find all files to copy from $(JDK_OUTPUTDIR)/lib
 diff --git a/jdk/make/Import.gmk b/jdk/make/Import.gmk
 index b115fa7f86..29fa2662a6 100644
 --- a/jdk/make/Import.gmk
 +++ b/jdk/make/Import.gmk
@@ -114,7 +114,7 @@ endef
 #
 # Import hotspot
 #
 -HOTSPOT_IMPORT_FILES := $(addprefix $(LIBRARY_PREFIX), jvm.* saproc.* jsig.* sawindbg.* jvm_db.* jvm_dtrace.*) \
 +HOTSPOT_IMPORT_FILES := $(addprefix $(LIBRARY_PREFIX), jvm.* saproc.* jsig.* sawindbg.* jvm_db.* jvm_dtrace.* ffi.*) \
     Xusage.txt sa-jdi.jar
 ifeq ($(OPENJDK_TARGET_OS), macosx)
 diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
 index c2460105b7..cf2ef251ac 100644
 --- a/make/devkit/Tools.gmk
 +++ b/make/devkit/Tools.gmk
@@ -82,8 +82,8 @@ RPM_LIST := \
     libXi libXi-devel \
     libXdmcp libXdmcp-devel \
     libXau libXau-devel \
 -    libgcc
 -
 +    libgcc \
 +    libffi libffi-devel
 ifeq ($(ARCH),x86_64)
   RPM_DIR ?= $(RPM_DIR_x86_64)
@@ -203,6 +203,18 @@ $(libs) : $(rpms)
 	@mkdir -p $(SYSROOT)/usr/lib
 	@touch $@
 +##########################################################################################
 +# Create links for ffi header files so that they become visible by default when using the
 +# devkit.
 +
 +$(SYSROOT)/usr/include/ffi.h: $(rpms)
 +	cd $(@D) && rm $(@F) && ln -s ../lib/libffi-*/include/$(@F) .
 +
 +$(SYSROOT)/usr/include/ffitarget.h: $(rpms)
 +	cd $(@D) && rm $(@F) && ln -s ../lib/libffi-*/include/$(@F) .
 +
 +SYSROOT_LINKS += $(SYSROOT)/usr/include/ffi.h $(SYSROOT)/usr/include/ffitarget.h
 +
 ##########################################################################################
 # Define marker files for each source package to be compiled
@@ -479,7 +491,7 @@ rpms : $(rpms)
 libs : $(libs)
 sysroot : rpms libs
 gcc : sysroot $(gcc) $(gccpatch)
 -all : binutils gcc bfdlib $(PREFIX)/devkit.info
 +all : binutils gcc bfdlib $(PREFIX)/devkit.info $(SYSROOT_LINKS)
 # this is only built for host. so separate.
 ccache : $(ccache)
--- a/SOURCES/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch
+++ b/SOURCES/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch
@ -7,10 +7,11 @@
 PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations
 Summary: Enable -mstackrealign on x86 Linux as well as x86 Mac OS X
-diff --git openjdk.orig///common/autoconf/flags.m4 openjdk///common/autoconf/flags.m4
+diff --git a/common/autoconf/flags.m4 b/common/autoconf/flags.m4
--- openjdk.orig///common/autoconf/flags.m4
+index 113bf367e2..bed030e8d1 100644
-+++ openjdk///common/autoconf/flags.m4
+--- a/common/autoconf/flags.m4
-@@ -402,6 +402,21 @@
+++ b/common/autoconf/flags.m4
@@ -451,6 +451,21 @@ AC_DEFUN_ONCE([FLAGS_SETUP_COMPILER_FLAGS_FOR_JDK],
     AC_SUBST($2CXXSTD_CXXFLAG)
   fi
@ -32,23 +33,32 @@ diff --git openjdk.orig///common/autoconf/flags.m4 openjdk///common/autoconf/fla
   if test "x$CFLAGS" != "x${ADDED_CFLAGS}"; then
     AC_MSG_WARN([Ignoring CFLAGS($CFLAGS) found in environment. Use --with-extra-cflags])
   fi
-diff --git openjdk.orig///common/autoconf/hotspot-spec.gmk.in openjdk///common/autoconf/hotspot-spec.gmk.in
+diff --git a/common/autoconf/hotspot-spec.gmk.in b/common/autoconf/hotspot-spec.gmk.in
--- openjdk.orig///common/autoconf/hotspot-spec.gmk.in
+index 3f86751d2b..f8a271383f 100644
-+++ openjdk///common/autoconf/hotspot-spec.gmk.in
+--- a/common/autoconf/hotspot-spec.gmk.in
-@@ -112,7 +112,8 @@
+++ b/common/autoconf/hotspot-spec.gmk.in
- RC:=@HOTSPOT_RC@
+@@ -114,13 +114,14 @@ RC:=@HOTSPOT_RC@
- 
+ # Retain EXTRA_{CFLAGS,CXXFLAGS,LDFLAGS,ASFLAGS} for the target flags to
- EXTRA_CFLAGS=@LEGACY_EXTRA_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
+ # maintain compatibility with the existing Makefiles
-				   $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
+ EXTRA_CFLAGS=@LEGACY_TARGET_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
-+				   $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG) \
+-				    $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
-+				   $(REALIGN_CFLAG)
+                                   $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG) \
- EXTRA_CXXFLAGS=@LEGACY_EXTRA_CXXFLAGS@
+                                   $(REALIGN_CFLAG)
- EXTRA_LDFLAGS=@LEGACY_EXTRA_LDFLAGS@
+ EXTRA_CXXFLAGS=@LEGACY_TARGET_CXXFLAGS@
- EXTRA_ASFLAGS=@LEGACY_EXTRA_ASFLAGS@
+ EXTRA_LDFLAGS=@LEGACY_TARGET_LDFLAGS@
-diff --git openjdk.orig///common/autoconf/spec.gmk.in openjdk///common/autoconf/spec.gmk.in
+ EXTRA_ASFLAGS=@LEGACY_TARGET_ASFLAGS@
--- openjdk.orig///common/autoconf/spec.gmk.in
+ # Define an equivalent set for the host flags (i.e. without sysroot options)
-+++ openjdk///common/autoconf/spec.gmk.in
+ HOST_CFLAGS=@LEGACY_HOST_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
-@@ -366,6 +366,7 @@
+-				 $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
 +                                 $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
 HOST_CXXFLAGS=@LEGACY_HOST_CXXFLAGS@
 HOST_LDFLAGS=@LEGACY_HOST_LDFLAGS@
 HOST_ASFLAGS=@LEGACY_HOST_ASFLAGS@
 diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
 index 9573bb2cbd..fe7efc130c 100644
 --- a/common/autoconf/spec.gmk.in
 +++ b/common/autoconf/spec.gmk.in
@@ -366,6 +366,7 @@ CXXFLAGS_JDKEXE:=@CXXFLAGS_JDKEXE@
 NO_DELETE_NULL_POINTER_CHECKS_CFLAG=@NO_DELETE_NULL_POINTER_CHECKS_CFLAG@
 NO_LIFETIME_DSE_CFLAG=@NO_LIFETIME_DSE_CFLAG@
--- a/SOURCES/jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch
+++ b/SOURCES/jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch
@ -1,67 +0,0 @@
 # HG changeset patch
 # User Andrew John Hughes <gnu_andrew@member.fsf.org>
 # Date 1620365804 -3600
 #      Fri May 07 06:36:44 2021 +0100
 # Node ID 39b62f35eca823b4c9a98bc1dc0cb9acb87360f8
 # Parent  723b59ed1afe878c5cd35f080399c8ceec4f776b
 PR3836: Extra compiler flags not passed to adlc build
 diff --git openjdk.orig/hotspot/make/aix/makefiles/adlc.make openjdk/hotspot/make/aix/makefiles/adlc.make
 --- openjdk.orig/hotspot/make/aix/makefiles/adlc.make
 +++ openjdk/hotspot/make/aix/makefiles/adlc.make
@@ -69,6 +69,11 @@
 CFLAGS_WARN = -w
 CFLAGS += $(CFLAGS_WARN)
 +# Extra flags from gnumake's invocation or environment
 +CFLAGS += $(EXTRA_CFLAGS)
 +LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
 +ASFLAGS += $(EXTRA_ASFLAGS)
 +
 OBJECTNAMES = \
 	adlparse.o \
 	archDesc.o \
 diff --git openjdk.orig/hotspot/make/bsd/makefiles/adlc.make openjdk/hotspot/make/bsd/makefiles/adlc.make
 --- openjdk.orig/hotspot/make/bsd/makefiles/adlc.make
 +++ openjdk/hotspot/make/bsd/makefiles/adlc.make
@@ -71,6 +71,11 @@
 endif
 CFLAGS += $(CFLAGS_WARN)
 +# Extra flags from gnumake's invocation or environment
 +CFLAGS += $(EXTRA_CFLAGS)
 +LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
 +ASFLAGS += $(EXTRA_ASFLAGS)
 +
 OBJECTNAMES = \
 	adlparse.o \
 	archDesc.o \
 diff --git openjdk.orig/hotspot/make/linux/makefiles/adlc.make openjdk/hotspot/make/linux/makefiles/adlc.make
 --- openjdk.orig/hotspot/make/linux/makefiles/adlc.make
 +++ openjdk/hotspot/make/linux/makefiles/adlc.make
@@ -69,6 +69,11 @@
 CFLAGS_WARN = $(WARNINGS_ARE_ERRORS)
 CFLAGS += $(CFLAGS_WARN)
 +# Extra flags from gnumake's invocation or environment
 +CFLAGS += $(EXTRA_CFLAGS)
 +LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
 +ASFLAGS += $(EXTRA_ASFLAGS)
 +
 OBJECTNAMES = \
 	adlparse.o \
 	archDesc.o \
 diff --git openjdk.orig/hotspot/make/solaris/makefiles/adlc.make openjdk/hotspot/make/solaris/makefiles/adlc.make
 --- openjdk.orig/hotspot/make/solaris/makefiles/adlc.make
 +++ openjdk/hotspot/make/solaris/makefiles/adlc.make
@@ -85,6 +85,10 @@
 endif
 CFLAGS += $(CFLAGS_WARN)
 +# Extra flags from gnumake's invocation or environment
 +CFLAGS += $(EXTRA_CFLAGS)
 +ASFLAGS += $(EXTRA_ASFLAGS)
 +
 ifeq ("${Platform_compiler}", "sparcWorks")
 # Enable the following CFLAGS addition if you need to compare the
 # built ELF objects.
--- a/SOURCES/jdk8328999-update_giflib_5.2.2.patch
+++ b/SOURCES/jdk8328999-update_giflib_5.2.2.patch
--- a/SOURCES/s390-8214206_fix.patch
+++ b/SOURCES/s390-8214206_fix.patch
@ -16,7 +16,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenan
   Atomic::add(val, &_sum);
 -  int mag = log2_intptr(val) + 1;
-+  int mag = log2_intptr((uintptr_t)val) + 1;
+  int mag = log2_long(val) + 1;
   // Defensively saturate for product bits:
   if (mag < 0) {
--- a/SPECS/java-1.8.0-openjdk.spec
+++ b/SPECS/java-1.8.0-openjdk.spec
`@ -1,2 +1,2 @@`
	`SOURCES/shenandoah8u422-b05.tar.xz`	`SOURCES/shenandoah8u452-b09.tar.xz`
	`SOURCES/tapsets-icedtea-3.15.0.tar.xz`	`SOURCES/tapsets-icedtea-3.15.0.tar.xz`
`@ -1,2 +1,2 @@`
	`e2828a59a56b737f58f33dc21f654e92bdfc085e SOURCES/shenandoah8u422-b05.tar.xz`	`c09d806f1a991cd77d3f15bb35ff69cb9d1bdbc0 SOURCES/shenandoah8u452-b09.tar.xz`
	`7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz`	`7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz`