1717 lines
105 KiB
Plaintext
1717 lines
105 KiB
Plaintext
Key:
|
|
|
|
JDK-X - https://bugs.openjdk.java.net/browse/JDK-X
|
|
CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
|
|
|
|
New in release OpenJDK 8u332 (2022-04-22):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bit.ly/openjdk8u332
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u332.txt
|
|
|
|
* Security fixes
|
|
- JDK-8269938: Enhance XML processing passes redux
|
|
- JDK-8270504, CVE-2022-21426: Better XPath expression handling
|
|
- JDK-8272255: Completely handle MIDI files
|
|
- JDK-8272261: Improve JFR recording file processing
|
|
- JDK-8272594: Better record of recordings
|
|
- JDK-8274221: More definite BER encodings
|
|
- JDK-8275151, CVE-2022-21443: Improved Object Identification
|
|
- JDK-8277227: Better identification of OIDs
|
|
- JDK-8277672, CVE-2022-21434: Better invocation handler handling
|
|
- JDK-8278008, CVE-2022-21476: Improve Santuario processing
|
|
- JDK-8278356: Improve file creation
|
|
- JDK-8278449: Improve keychain support
|
|
- JDK-8278805: Enhance BMP image loading
|
|
- JDK-8278972, CVE-2022-21496: Improve URL supports
|
|
- JDK-8281388: Change wrapping of EncryptedPrivateKeyInfo
|
|
* Other changes
|
|
- JDK-8033980: Xerces Update: datatype XMLGregorianCalendarImpl and DurationImpl
|
|
- JDK-8035437: Xerces Update: xml/serialize/DOMSerializerImpl
|
|
- JDK-8035577: Xerces Update: impl/xpath/regex/RangeToken.java
|
|
- JDK-8037259: xerces update: xpointer update
|
|
- JDK-8041523: Xerces Update: Serializer improvements from Xalan
|
|
- JDK-8141508: java.lang.invoke.LambdaConversionException: Invalid receiver type
|
|
- JDK-8162572: Update License Header for all JAXP sources
|
|
- JDK-8167014: jdeps: Missing message: warn.skipped.entry
|
|
- JDK-8198411: [TEST_BUG] Two java2d tests are unstable in mach5
|
|
- JDK-8202822: Add .git to .hgignore
|
|
- JDK-8205540: test/hotspot/jtreg/vmTestbase/nsk/jdb/trace/trace001/trace001.java fails with Debuggee did not exit after 15 <cont> commands
|
|
- JDK-8209178: Proxied HttpsURLConnection doesn't send BODY when retrying POST request
|
|
- JDK-8210283: Support git as an SCM alternative in the build
|
|
- JDK-8218682: [TEST_BUG] DashOffset fails in mach5
|
|
- JDK-8225690: Multiple AttachListener threads can be created
|
|
- JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due to "exit code is 134"
|
|
- JDK-8227815: Minimal VM: set_state is not a member of AttachListener
|
|
- JDK-8240633: Memory leaks in the implementations of FileChooserUI
|
|
- JDK-8241768: git needs .gitattributes
|
|
- JDK-8247766: [aarch64] guarantee(val < (1U << nbits)) failed: Field too big for insn
|
|
- JDK-8253147: The javax/swing/JPopupMenu/7154841/bug7154841.java fail on big screens
|
|
- JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
|
|
- JDK-8266749: AArch64: Backtracing broken on PAC enabled systems
|
|
- JDK-8270290: NTLM authentication fails if HEAD request is used
|
|
- JDK-8273229: Update OS detection code to recognize Windows Server 2022
|
|
- JDK-8273341: Update Siphash to version 1.0
|
|
- JDK-8273575: memory leak in appendBootClassPath(), paths must be deallocated
|
|
- JDK-8274524: SSLSocket.close() hangs if it is called during the ssl handshake
|
|
- JDK-8277224: sun.security.pkcs.PKCS9Attributes.toString() throws NPE
|
|
- JDK-8277488: Add expiry exception for Digicert (geotrustglobalca) expiring in May 2022
|
|
- JDK-8279077: JFR crashes on Linux ppc due to missing crash protector in signal handler
|
|
- JDK-8280060: The sun/rmi/server/Activation.java class use Thread.dumpStack()
|
|
- JDK-8282300: Throws NamingException instead of InvalidNameException after JDK-8278972
|
|
- JDK-8282397: createTempFile method of java.io.File is failing when called with suffix of spaces character
|
|
- JDK-8284548: Invalid XPath expression causes StringIndexOutOfBoundsException
|
|
- JDK-8284920: Incorrect Token type causes XPath expression to return empty result
|
|
- JDK-8284936: Fix Java 7 bootstrap breakage due to use of Arrays.stream
|
|
* Shenandoah
|
|
- JDK-8260632: Build failures after JDK-8253353
|
|
- JDK-8282458: Update .jcheck/conf file for sh-jdk8u move to git
|
|
|
|
New in release OpenJDK 8u322 (2022-01-18):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u322
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u322.txt
|
|
|
|
* Security fixes
|
|
- JDK-8264934, CVE-2022-21248: Enhance cross VM serialization
|
|
- JDK-8268488: More valuable DerValues
|
|
- JDK-8268494: Better inlining of inlined interfaces
|
|
- JDK-8268512: More content for ContentInfo
|
|
- JDK-8268795: Enhance digests of Jar files
|
|
- JDK-8268801: Improve PKCS attribute handling
|
|
- JDK-8268813, CVE-2022-21283: Better String matching
|
|
- JDK-8269151: Better construction of EncryptedPrivateKeyInfo
|
|
- JDK-8269944: Better HTTP transport redux
|
|
- JDK-8270392, CVE-2022-21293: Improve String constructions
|
|
- JDK-8270416, CVE-2022-21294: Enhance construction of Identity maps
|
|
- JDK-8270492, CVE-2022-21282: Better resolution of URIs
|
|
- JDK-8270498, CVE-2022-21296: Improve SAX Parser configuration management
|
|
- JDK-8270646, CVE-2022-21299: Improved scanning of XML entities
|
|
- JDK-8271962: Better TrueType font loading
|
|
- JDK-8271968: Better canonical naming
|
|
- JDK-8271987: Manifest improved manifest entries
|
|
- JDK-8272014, CVE-2022-21305: Better array indexing
|
|
- JDK-8272026, CVE-2022-21340: Verify Jar Verification
|
|
- JDK-8272236, CVE-2022-21341: Improve serial forms for transport
|
|
- JDK-8272272: Enhance jcmd communication
|
|
- JDK-8272462: Enhance image handling
|
|
- JDK-8273290: Enhance sound handling
|
|
- JDK-8273748, CVE-2022-21349: Improve Solaris font rendering
|
|
- JDK-8273756, CVE-2022-21360: Enhance BMP image support
|
|
- JDK-8273838, CVE-2022-21365: Enhanced BMP processing
|
|
* Other changes
|
|
- JDK-6801613: Cross-platform pageDialog and printDialog top margin entry broken
|
|
- JDK-8011541: [TEST_BUG] closed/javax/swing/plaf/metal/MetalUtils/bug6190373.java fails NPE since 7u25b03
|
|
- JDK-8025430: [TEST_BUG] javax/swing/JEditorPane/5076514/bug5076514.java failed since jdk8b108
|
|
- JDK-8041928: MouseEvent.getModifiersEx gives wrong result
|
|
- JDK-8042199: The build of J2DBench via makefile is broken after the JDK-8005402
|
|
- JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining group (OS X 10.9)
|
|
- JDK-8048021: Remove @version tag in jaxp repo
|
|
- JDK-8049348: compiler/intrinsics/bmi/verifycode tests on lzcnt and tzcnt use incorrect assumption about REXB prefix usage
|
|
- JDK-8060027: Tests java/beans/XMLEncoder/Test4903007.java and java/beans/XMLEncoder/java_awt_GridBagLayout.java
|
|
- JDK-8066588: javax/management/remote/mandatory/connection/RMIConnector_NPETest.java fails to compile
|
|
- JDK-8066652: Default TimeZone is GMT not local if user.timezone is invalid on Mac OS
|
|
- JDK-8069034: gc/g1/TestEagerReclaimHumongousRegionsClearMarkBits.java nightly failure
|
|
- JDK-8077590: windows_i586_6.2-product-c2-runThese8_Xcomp_vm failing after win compiler upgrade
|
|
- JDK-8080287: The image of BufferedImage.TYPE_INT_ARGB and BufferedImage.TYPE_INT_ARGB_PRE is blank
|
|
- JDK-8140329: [TEST_BUG] test FullScreenAfterSplash.java failed because image was not generated
|
|
- JDK-8140472: java/net/ipv6tests/TcpTest.java failed intermittently with java.net.BindException: Address already in use: NET_Bind
|
|
- JDK-8147051: StaxEntityResolverWrapper should create StaxXMLInputSource with a resolver indicator
|
|
- JDK-8148915: Intermittent failures of bug6400879.java
|
|
- JDK-8176837: SunPKCS11 provider needs to check more details on PKCS11 Mechanism
|
|
- JDK-8177393: Result of RescaleOp for 4BYTE_ABGR images may be 25% black
|
|
- JDK-8177536: Avoid Apple Peer-to-Peer interfaces in networking tests
|
|
- JDK-8182036: Load from initializing arraycopy uses wrong memory state
|
|
- JDK-8183369: RFC unconformity of HttpURLConnection with proxy
|
|
- JDK-8183543: Aarch64: C2 compilation often fails with "failed spill-split-recycle sanity check"
|
|
- JDK-8187450: JNI local refs exceeds capacity warning in NetworkInterface::getAll
|
|
- JDK-8187649: ArrayIndexOutOfBoundsException in java.util.JapaneseImperialCalendar
|
|
- JDK-8190482: InnocuousThread creation should not require the caller to possess enableContextClassLoaderOverride
|
|
- JDK-8190793: Httpserver does not detect truncated request body
|
|
- JDK-8196572: Tests ColConvCCMTest.java and MTColConvTest.java fail
|
|
- JDK-8202788: Explicitly reclaim cached thread-local direct buffers at thread exit
|
|
- JDK-8210058: Algorithmic Italic font leans opposite angle in Printing
|
|
- JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs instead of aliased B&W glyphs
|
|
- JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021
|
|
- JDK-8225083: Remove Google certificate that is expiring in December 2021
|
|
- JDK-8226806: [macOS 10.14] Methods of Java Robot should be called from appropriate thread
|
|
- JDK-8231254: (fs) Add test for macOS Catalina changes to protect system software
|
|
- JDK-8231438: [macOS] Dark mode for the desktop is not supported
|
|
- JDK-8232178: MacVolumesTest failed after upgrade to MacOS Catalina
|
|
- JDK-8232226: [macos 10.15] test/jdk/java/awt/color/EqualityTest/EqualityTest.java may fail
|
|
- JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/DrawImageBG/SystemBgColorTest.java fails
|
|
- JDK-8236897: Fix the copyright header for pkcs11gcm2.h
|
|
- JDK-8237499: JFR: Include stack trace in the ThreadStart event
|
|
- JDK-8239886: Minimal VM build fails after JDK-8237499
|
|
- JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0
|
|
- JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during "PrinterJob.print"
|
|
- JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches all exceptions
|
|
- JDK-8273308: PatternMatchTest.java fails on CI
|
|
- JDK-8273342: Null pointer dereference in classFileParser.cpp:2817
|
|
- JDK-8273826: Correct Manifest file name and NPE checks
|
|
- JDK-8273968: JCK javax_xml tests fail in CI
|
|
- JDK-8274407: (tz) Update Timezone Data to 2021c
|
|
- JDK-8274467: TestZoneInfo310.java fails with tzdata2021b
|
|
- JDK-8274468: TimeZoneTest.java fails with tzdata2021b
|
|
- JDK-8274595: DisableRMIOverHTTPTest failed: connection refused
|
|
- JDK-8274779: HttpURLConnection: HttpClient and HttpsClient incorrectly check request method when set to POST
|
|
- JDK-8275766: (tz) Update Timezone Data to 2021e
|
|
- JDK-8275849: TestZoneInfo310.java fails with tzdata2021e
|
|
- JDK-8276536: Update TimeZoneNames files to follow the changes made by JDK-8275766
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
security-libs/java.security:
|
|
|
|
JDK-8271434: Removed IdenTrust Root Certificate
|
|
===============================================
|
|
The following root certificate from IdenTrust has been removed from
|
|
the `cacerts` keystore:
|
|
|
|
Alias Name: identrustdstx3 [jdk]
|
|
Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co.
|
|
|
|
JDK-8272535: Removed Google's GlobalSign Root Certificate
|
|
=========================================================
|
|
The following root certificate from Google has been removed from the
|
|
`cacerts` keystore:
|
|
|
|
Alias Name: globalsignr2ca [jdk]
|
|
Distinguished Name: CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2
|
|
|
|
core-libs/java.time:
|
|
|
|
JDK-8274857: Update Timezone Data to 2021c
|
|
===========================================
|
|
IANA Time Zone Database, on which JDK's Date/Time libraries are based,
|
|
has been updated to version 2021c
|
|
(https://mm.icann.org/pipermail/tz-announce/2021-October/000067.html). Note
|
|
that with this update, some of the time zone rules prior to the year
|
|
1970 have been modified according to the changes which were introduced
|
|
with 2021b. For more detail, refer to the announcement of 2021b
|
|
(https://mm.icann.org/pipermail/tz-announce/2021-September/000066.html)
|
|
|
|
New in release OpenJDK 8u312 (2021-10-19):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u312
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u312.txt
|
|
|
|
* Security fixes
|
|
- JDK-8130183, CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if InnerClasses attribute's inner_class_info_index is 0
|
|
- JDK-8161016: Strange behavior of URLConnection with proxy
|
|
- JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference
|
|
- JDK-8254967, CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close
|
|
- JDK-8263314: Enhance XML Dsig modes
|
|
- JDK-8265167, CVE-2021-35556: Richer Text Editors
|
|
- JDK-8265574: Improve handling of sheets
|
|
- JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit
|
|
- JDK-8265776: Improve Stream handling for SSL
|
|
- JDK-8266097, CVE-2021-35561: Better hashing support
|
|
- JDK-8266103: Better specified spec values
|
|
- JDK-8266109: More Resilient Classloading
|
|
- JDK-8266115: More Manifest Jar Loading
|
|
- JDK-8266137, CVE-2021-35564: Improve Keystore integrity
|
|
- JDK-8266689, CVE-2021-35567: More Constrained Delegation
|
|
- JDK-8267086: ArrayIndexOutOfBoundsException in java.security.KeyFactory.generatePublic
|
|
- JDK-8267712: Better LDAP reference processing
|
|
- JDK-8267729, CVE-2021-35578: Improve TLS client handshaking
|
|
- JDK-8267735, CVE-2021-35586: Better BMP support
|
|
- JDK-8268193: Improve requests of certificates
|
|
- JDK-8268199: Correct certificate requests
|
|
- JDK-8268506: More Manifest Digests
|
|
- JDK-8269618, CVE-2021-35603: Better session identification
|
|
- JDK-8269624: Enhance method selection support
|
|
- JDK-8270398: Enhance canonicalization
|
|
- JDK-8270404: Better canonicalization
|
|
* Other changes
|
|
- JDK-6847157: java.lang.NullPointerException: HDC for component at sun.java2d.loops.Blit.Blit
|
|
- JDK-7146776: deadlock between URLStreamHandler.getHostAddress and file.Handler.openconnection
|
|
- JDK-7188942: Remove support of pbuffers in OGL Java2d pipeline
|
|
- JDK-8004148: NPE in sun.awt.SunToolkit.getWindowDeactivationTime
|
|
- JDK-8022323: [JavaSecurityScanner] review package com.sun.management.* Native methods should be private
|
|
- JDK-8027154: [TESTBUG] Test java/awt/Mouse/GetMousePositionTest/GetMousePositionWithPopup.java fails
|
|
- JDK-8035001: TEST_BUG: the retry logic in RMID.start() should check that the subprocess hasn't terminated
|
|
- JDK-8035424: (reflect) Performance problem in sun.reflect.generics.parser.SignatureParser
|
|
- JDK-8042557: compiler/uncommontrap/TestSpecTrapClassUnloading.java fails with: GC triggered before VM initialization completed
|
|
- JDK-8054118: java/net/ipv6tests/UdpTest.java failed intermittently
|
|
- JDK-8065215: Print warning summary at end of configure
|
|
- JDK-8072767: DefaultCellEditor for comboBox creates ActionEvent with wrong source object
|
|
- JDK-8079891: Store configure log in $BUILD/configure.log
|
|
- JDK-8080082: configure fails if you create an empty directory and then run configure from it
|
|
- JDK-8086003: Test fails on OSX with java.lang.RuntimeException 'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3' missing
|
|
- JDK-8131062: aarch64: add support for GHASH acceleration
|
|
- JDK-8134869: AARCH64: GHASH intrinsic is not optimal
|
|
- JDK-8134989: java/net/MulticastSocket/TestInterfaces.java failed due to unexpected IP address
|
|
- JDK-8156584: Initialization race in sun.security.x509.AlgorithmId.get
|
|
- JDK-8157404: Unable to read certain PKCS12 keystores from SequenceInputStream
|
|
- JDK-8166673: The new implementation of Robot.waitForIdle() may hang
|
|
- JDK-8170467: (reflect) Optimize SignatureParser's use of StringBuilders
|
|
- JDK-8194246: JVM crashes when calling getStackTrace if stack contains a method that is a member of a very large class
|
|
- JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
|
|
- JDK-8202837: PBES2 AlgorithmId encoding error in PKCS12 KeyStore
|
|
- JDK-8206189: sun/security/pkcs12/EmptyPassword.java fails with Sequence tag error
|
|
- JDK-8214418: half-closed SSLEngine status may cause application dead loop
|
|
- JDK-8214513: A PKCS12 keystore from Java 8 using custom PBE parameters cannot be read in Java 11
|
|
- JDK-8220786: Create new switch to redirect error reporting output to stdout or stderr
|
|
- JDK-8222751: closed/test/jdk/sun/security/util/DerIndefLenConverter/IndefBerPkcs12.java fail
|
|
- JDK-8229243: SunPKCS11-Solaris provider tests failing on Solaris 11.4
|
|
- JDK-8231222: fix pkcs11 P11_DEBUG guarded native traces
|
|
- JDK-8237495: Java MIDI fails with a dereferenced memory error when asked to send a raw 0xF7
|
|
- JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers
|
|
- JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print
|
|
- JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)
|
|
- JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header files
|
|
- JDK-8247469: getSystemCpuLoad() returns -1 on linux when some offline cpus are present and cpusets.effective_cpus is not available
|
|
- JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.
|
|
- JDK-8259338: Add expiry exception for identrustdstx3 alias to VerifyCACerts.java test
|
|
- JDK-8262000: jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with "OutOfMemoryError: Java heap space"
|
|
- JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()
|
|
- JDK-8263311: Watch registry changes for remote printers update instead of polling
|
|
- JDK-8263382: java/util/logging/ParentLoggersTest.java failed with "checkLoggers: getLoggerNames() returned unexpected loggers"
|
|
- JDK-8264752: SIGFPE crash with option FlightRecorderOptions:threadbuffersize=30M
|
|
- JDK-8265238: [8u] [macos] build failure in OpenJDK8u after JDK-8211301 in older xcode
|
|
- JDK-8265836: OperatingSystemImpl.getCpuLoad() returns incorrect CPU load inside a container
|
|
- JDK-8265978: make test should look for more locations when searching for exit code
|
|
- JDK-8266206: Build failure after JDK-8264752 with older GCCs
|
|
- JDK-8268103: JNI functions incorrectly return a double after JDK-8265836
|
|
- JDK-8268965: TCP Connection Reset when connecting simple socket to SSL server
|
|
- JDK-8269594: assert(_handle_mark_nesting > 1) failed: memory leak: allocating handle outside HandleMark
|
|
- JDK-8269763: The JEditorPane is blank after JDK-8265167
|
|
- JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
|
|
- JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu usage in containers
|
|
- JDK-8269859: BacktraceBuilder._cprefs needs to be accessed as unsigned short
|
|
- JDK-8269882: stack-use-after-scope in NewObjectA
|
|
- JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891
|
|
- JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm Setup
|
|
- JDK-8271466: StackGap test fails on aarch64 due to "-m64"
|
|
- JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path contains colon
|
|
- JDK-8272214: [8u] Build failure after backport of JDK-8248901
|
|
- JDK-8272714: [8u] Build failure after backport of JDK-8248901 with MSVC 2013
|
|
* Shenandoah
|
|
- [backport] JDK-8269661: JNI_GetStringCritical does not lock char array
|
|
- Re-cast JNI critical strings patch to be Shenandoah-specific
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
core-libs/java.net:
|
|
|
|
JDK-8164200: Modified HttpURLConnection behavior when no suitable proxy is found
|
|
================================================================================
|
|
The behavior of HttpURLConnection when using a ProxySelector has been
|
|
modified with this JDK release. HttpURLConnection used to fall back to
|
|
a DIRECT connection attempt if the configured proxy(s) failed to make
|
|
a connection. This release introduces a change whereby no DIRECT
|
|
connection will be attempted in such a scenario. Instead, the
|
|
HttpURLConnection.connect() method will fail and throw an IOException
|
|
which occurred from the last proxy tested.
|
|
|
|
security-libs/javax.net.ssl:
|
|
|
|
JDK-8219551: Updated the Default Enabled Cipher Suites Preference
|
|
=================================================================
|
|
The preference of the default enabled cipher suites has been
|
|
changed. The compatibility impact should be minimal. If needed,
|
|
applications can customize the enabled cipher suites and the
|
|
preference. For more details, refer to the SunJSSE provider
|
|
documentation and the JSSE Reference Guide documentation.
|
|
|
|
New in release OpenJDK 8u302 (2021-07-20):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u302
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u302.txt
|
|
|
|
* Security fixes
|
|
- JDK-8256157: Improve bytecode assembly
|
|
- JDK-8256491: Better HTTP transport
|
|
- JDK-8258432, CVE-2021-2341: Improve file transfers
|
|
- JDK-8260453: Improve Font Bounding
|
|
- JDK-8260960: Signs of jarsigner signing
|
|
- JDK-8260967, CVE-2021-2369: Better jar file validation
|
|
- JDK-8262380: Enhance XML processing passes
|
|
- JDK-8262403: Enhanced data transfer
|
|
- JDK-8262410: Enhanced rules for zones
|
|
- JDK-8262477: Enhance String Conclusions
|
|
- JDK-8262967: Improve Zip file support
|
|
- JDK-8264066, CVE-2021-2388: Enhance compiler validation
|
|
- JDK-8264079: Improve abstractions
|
|
- JDK-8264460: Improve NTLM support
|
|
* Other changes
|
|
- JDK-6878250: (so) IllegalBlockingModeException thrown when reading from a closed SocketChannel's InputStream
|
|
- JDK-6990210: [TEST_BUG] EventDispatchThread/HandleExceptionOnEDT/HandleExceptionOnEDT.java fails on gnome
|
|
- JDK-7059970: Test case: javax/imageio/plugins/png/ITXtTest.java is not closing a file
|
|
- JDK-7106851: Test should not use System.exit
|
|
- JDK-8019470: Changes needed to compile JDK 8 on MacOS with clang compiler
|
|
- JDK-8028618: [TEST BUG] javax/swing/JScrollBar/bug4202954/bug4202954.java fails
|
|
- JDK-8030123: java/beans/Introspector/Test8027648.java fails
|
|
- JDK-8032050: Clean up for java/rmi/activation/Activatable/shutdownGracefully/ShutdownGracefully.java
|
|
- JDK-8033289: clang: clean up unused function warning
|
|
- JDK-8034856: gcc warnings compiling src/solaris/native/sun/security/pkcs11
|
|
- JDK-8034857: gcc warnings compiling src/solaris/native/sun/management
|
|
- JDK-8035000: clean up ActivationLibrary.DestroyThread
|
|
- JDK-8035054: JarFacade.c should not include ctype.h
|
|
- JDK-8035287: gcc warnings compiling various libraries files
|
|
- JDK-8036095: RMI tests using testlibrary.RMID and testlibrary.JavaVM do not pass through vmoptions
|
|
- JDK-8037825: Fix warnings and enable "warnings as errors" in serviceability native libraries
|
|
- JDK-8042891: Format issues embedded in macros for two g1 source files
|
|
- JDK-8043264: hsdis library not picked up correctly on expected paths
|
|
- JDK-8043646: libosxapp.dylib fails to build on Mac OS 10.9 with clang
|
|
- JDK-8047939: [TESTBUG] Rewrite test/runtime/8001071/Test8001071.sh
|
|
- JDK-8055754: filemap.cpp does not compile with clang
|
|
- JDK-8064909: FragmentMetaspace.java got OutOfMemoryError
|
|
- JDK-8066508: JTReg tests timeout on slow devices when run using JPRT
|
|
- JDK-8066807: langtools/test/Makefile should use -agentvm not -samevm
|
|
- JDK-8071374: -XX:+PrintAssembly -XX:+PrintSignatureHandlers crash fastdebug VM with assert(limit == __null || limit <= nm->code_end()) in RelocIterator::initialize
|
|
- JDK-8073446: TimeZone getOffset API does not return a dst offset between years 2038-2137
|
|
- JDK-8074835: Resolve disabled warnings for libj2gss
|
|
- JDK-8074836: Resolve disabled warnings for libosxkrb5
|
|
- JDK-8075071: [TEST_BUG] TimSortStackSize2.java: OOME: Java heap space: MaxHeap shrinked by MaxRAMFraction
|
|
- JDK-8077364: "if( !this )" construct prevents build on Xcode 6.3
|
|
- JDK-8078855: [TEST_BUG] javax/swing/JComboBox/8032878/bug8032878.java fails in WindowsClassicLookAndFeel
|
|
- JDK-8081764: [TEST_BUG] Test javax/swing/plaf/aqua/CustomComboBoxFocusTest.java fails on Windows, Solaris Sparcv9 and Linux but passes on MacOSX
|
|
- JDK-8129511: PlatformMidi.c:83 uses malloc without malloc header
|
|
- JDK-8130308: Too low memory usage in TestPromotionFromSurvivorToTenuredAfterMinorGC.java
|
|
- JDK-8130430: [TEST_BUG] remove unnecessary internal calls from javax/swing/JRadioButton/8075609/bug8075609.java
|
|
- JDK-8132148: G1 hs_err region dump legend out of sync with region values
|
|
- JDK-8132709: [TESTBUG] gc/g1/TestHumongousShrinkHeap.java might fail on embedded
|
|
- JDK-8134672: [TEST_BUG] Some tests should check isDisplayChangeSupported
|
|
- JDK-8134883: C1 hard crash in range check elimination in Nashorn test262parallel
|
|
- JDK-8136592: [TEST_BUG] Fix 2 platform-specific closed regtests for jigsaw
|
|
- JDK-8138820: JDK Hotspot build fails with Xcode 7.0.1
|
|
- JDK-8151786: [TESTBUG] java/beans/XMLEncoder/Test4625418.java timed out intermittently
|
|
- JDK-8159898: Negative array size in java/beans/Introspector/Test8027905.java
|
|
- JDK-8166046: [TESTBUG] compiler/stringopts/TestStringObjectInitialization.java fails with OOME
|
|
- JDK-8166724: gc/g1/TestHumongousShrinkHeap.java fails with OOME
|
|
- JDK-8172188: JDI tests fail due to "permission denied" when creating temp file
|
|
- JDK-8177809: File.lastModified() is losing milliseconds (always ends in 000)
|
|
- JDK-8178403: DirectAudio in JavaSound may hang and leak
|
|
- JDK-8180478: tools/launcher/MultipleJRE.sh fails on Windows because of extra-''
|
|
- JDK-8183910: gc/arguments/TestAggressiveHeap.java fails intermittently
|
|
- JDK-8190332: PngReader throws NegativeArraySizeException/OOM error when IHDR width is very large
|
|
- JDK-8190679: java/util/Arrays/TimSortStackSize2.java fails with "Initial heap size set to a larger value than the maximum heap size"
|
|
- JDK-8191955: AArch64: incorrect prefetch distance causes an internal error
|
|
- JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java fails
|
|
- JDK-8199265: java/util/Arrays/TimSortStackSize2.java fails with OOM
|
|
- JDK-8200550: Xcode 9.3 produce warning -Wexpansion-to-defined
|
|
- JDK-8202299: Java Keystore fails to load PKCS12/PFX certificates created in WindowsServer2016
|
|
- JDK-8203196: C1 emits incorrect code due to integer overflow in _tableswitch keys
|
|
- JDK-8205014: com/sun/jndi/ldap/DeadSSLLdapTimeoutTest.java failed with "Read timed out"
|
|
- JDK-8206243: java -XshowSettings fails if memory.limit_in_bytes overflows LONG.max
|
|
- JDK-8206925: Support the certificate_authorities extension
|
|
- JDK-8209996: [PPC64] Fix JFR profiling
|
|
- JDK-8214345: infinite recursion while checking super class
|
|
- JDK-8217230: assert(t == t_no_spec) failure in NodeHash::check_no_speculative_types()
|
|
- JDK-8217348: assert(thread->is_Java_thread()) failed: just checking
|
|
- JDK-8225081: Remove Telia Company CA certificate expiring in April 2021
|
|
- JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
|
|
- JDK-8228757: Fail fast if the handshake type is unknown
|
|
- JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
|
|
- JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails intermittently with NPE
|
|
- JDK-8231841: AArch64: debug.cpp help() is missing an AArch64 line for pns
|
|
- JDK-8231949: [PPC64, s390]: Make async profiling more reliable
|
|
- JDK-8234011: (zipfs) Memory leak in ZipFileSystem.releaseDeflater()
|
|
- JDK-8239053: [8u] clean up undefined-var-template warnings
|
|
- JDK-8239400: [8u] clean up undefined-var-template warnings
|
|
- JDK-8241649: Optimize Character.toString
|
|
- JDK-8241829: Cleanup the code for PrinterJob on windows
|
|
- JDK-8242565: Policy initialization issues when the denyAfter constraint is enabled
|
|
- JDK-8243559: Remove root certificates with 1024-bit keys
|
|
- JDK-8247350: [aarch64] assert(false) failed: wrong size of mach node
|
|
- JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is unstable
|
|
- JDK-8249278: Revert JDK-8226253 which breaks the spec of AccessibleState.SHOWING for JList
|
|
- JDK-8250876: Fix issues with cross-compile on macos
|
|
- JDK-8252883: AccessDeniedException caused by delayed file deletion on Windows
|
|
- JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
|
|
- JDK-8254631: Better support ALPN byte wire values in SunJSSE
|
|
- JDK-8255086: Update the root locale display names
|
|
- JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
|
|
- JDK-8256818: SSLSocket that is never bound or connected leaks socket resources
|
|
- JDK-8257039: [8u] GenericTaskQueue destructor is incorrect
|
|
- JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java reports leaks
|
|
- JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java as automatic test
|
|
- JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java again reports leaks after JDK-8257884
|
|
- JDK-8257999: Parallel GC crash in gc/parallel/TestDynShrinkHeap.java: new region is not in covered_region
|
|
- JDK-8258419: RSA cipher buffer cleanup
|
|
- JDK-8258669: fastdebug jvm crashes when do event based tracing for monitor inflation
|
|
- JDK-8258753: StartTlsResponse.close() hangs due to synchronization issues
|
|
- JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails "assert(covered_region.contains(new_memregion)) failed: new region is not in covered_region"
|
|
- JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use condition is incorrect
|
|
- JDK-8259886: Improve SSL session cache performance and scalability
|
|
- JDK-8260029: aarch64: fix typo in verify_oop_array
|
|
- JDK-8260236: better init AnnotationCollector _contended_group
|
|
- JDK-8260255: C1: LoopInvariantCodeMotion constructor can leave some fields uninitialized
|
|
- JDK-8260484: CheckExamples.java / NoJavaLangTest.java fail with jtreg 4.2
|
|
- JDK-8260704: ParallelGC: oldgen expansion needs release-store for _end
|
|
- JDK-8261355: No data buffering in SunPKCS11 Cipher encryption when the underlying mechanism has no padding
|
|
- JDK-8261867: Backport relevant test changes & additions from JDK-8130125
|
|
- JDK-8262110: DST starts from incorrect time in 2038
|
|
- JDK-8262446: DragAndDrop hangs on Windows
|
|
- JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt stack
|
|
- JDK-8262730: Enable jdk8u MacOS external debug symbols
|
|
- JDK-8262864: No debug symbols in image for Windows --with-native-debug-symbols=external
|
|
- JDK-8263061: copy wrong unpack200 debuginfo to bin directory after 8252395
|
|
- JDK-8263504: Some OutputMachOpcodes fields are uninitialized
|
|
- JDK-8263600: change rmidRunning to a simple lookup
|
|
- JDK-8264509: jdk8u MacOS zipped debug symbols won't build
|
|
- JDK-8264562: assert(verify_field_bit(1)) failed: Attempting to write an uninitialized event field: type
|
|
- JDK-8264640: CMS ParScanClosure misses a barrier
|
|
- JDK-8264816: Weak handles leak causes GC to take longer
|
|
- JDK-8265462: Handle multiple slots in the NSS Internal Module from SunPKCS11's Secmod
|
|
- JDK-8265666: Enable AIX build platform to make external debug symbols
|
|
- JDK-8265832: runtime/StackGap/testme.sh fails to compile in 8u
|
|
- JDK-8265988: Fix sun/text/IntHashtable/Bug4170614 for JDK 8u
|
|
- JDK-8266191: Missing aarch64 parts of JDK-8181872 (C1: possible overflow when strength reducing integer multiply by constant)
|
|
- JDK-8266723: JFR periodic events are causing extra allocations
|
|
- JDK-8266929: Unable to use algorithms from 3p providers
|
|
- JDK-8267235: [macos_aarch64] InterpreterRuntime::throw_pending_exception messing up LR results in crash
|
|
- JDK-8267426: MonitorVmStartTerminate test timed out on Embedded VM
|
|
- JDK-8267545: [8u] Enable Xcode 12 builds on macOS
|
|
- JDK-8267689: [aarch64] Crash due to bad shift in indirect addressing mode
|
|
- JDK-8268444: keytool -v -list print is incorrect after backport JDK-8141457
|
|
- JDK-8269388: Default build of OpenJDK 8 fails on newer GCCs with warnings as errors on format-overflow
|
|
- JDK-8269468: JDK-8269388 breaks the build on older GCCs
|
|
- JDK-8270533: AArch64: size_fits_all_mem_uses should return false if its output is a CAS
|
|
* Shenandoah
|
|
- [backport] JDK-8259580: Shenandoah: uninitialized label in VerifyThreadGCState
|
|
- [backport] JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
|
|
- [backport] JDK-8261251: Shenandoah: Use object size for full GC humongous
|
|
- [backport] JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
|
|
- [backport] JDK-8265239: Shenandoah: Shenandoah heap region count could be off by 1
|
|
- [backport] JDK-8266802: Shenandoah: Round up region size to page size unconditionally
|
|
- [backport] JDK-8267561: Shenandoah: Reference processing not properly setup for outside of cycle degenerated GC
|
|
- [backport] JDK-8268127: Shenandoah: Heap size may be too small for region to align to large page size
|
|
- [backport] JDK-8268699: Shenandoah: Add test for JDK-8268127
|
|
- Shenandoah: Process weak roots during class unloading cycle
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
security-libs/java.security:
|
|
|
|
JDK-8256902: Removed Root Certificates with 1024-bit Keys
|
|
=========================================================
|
|
The following root certificates with weak 1024-bit RSA public keys
|
|
have been removed from the `cacerts` keystore:
|
|
|
|
Alias Name: thawtepremiumserverca [jdk]
|
|
Distinguished Name: EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA
|
|
|
|
Alias Name: verisignclass2g2ca [jdk]
|
|
Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US
|
|
|
|
Alias Name: verisignclass3ca [jdk]
|
|
Distinguished Name: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
|
|
|
|
Alias Name: verisignclass3g2ca [jdk]
|
|
Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US
|
|
|
|
Alias Name: verisigntsaca [jdk]
|
|
Distinguished Name: CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA
|
|
|
|
JDK-8261361: Removed Telia Company's Sonera Class2 CA certificate
|
|
=================================================================
|
|
|
|
The following root certificate have been removed from the cacerts truststore:
|
|
|
|
Alias Name: soneraclass2ca
|
|
Distinguished Name: CN=Sonera Class2 CA, O=Sonera, C=FI
|
|
|
|
security-libs/javax.net.ssl:
|
|
|
|
JDK-8257548: Improve Encoding of TLS Application-Layer Protocol Negotiation (ALPN) Values
|
|
=========================================================================================
|
|
Certain TLS ALPN values couldn't be properly read or written by the
|
|
SunJSSE provider. This is due to the choice of Strings as the API
|
|
interface and the undocumented internal use of the UTF-8 Character Set
|
|
which converts characters larger than U+00007F (7-bit ASCII) into
|
|
multi-byte arrays that may not be expected by a peer.
|
|
|
|
ALPN values are now represented using the network byte representation
|
|
expected by the peer, which should require no modification for
|
|
standard 7-bit ASCII-based character Strings. However, SunJSSE now
|
|
encodes/decodes String characters as 8-bit ISO_8859_1/LATIN-1
|
|
characters. This means applications that used characters above
|
|
U+000007F that were previously encoded using UTF-8 may need to either
|
|
be modified to perform the UTF-8 conversion, or set the Java security
|
|
property `jdk.tls.alpnCharset` to "UTF-8" revert the behavior.
|
|
|
|
See the updated guide at
|
|
https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/alpn.html
|
|
for more information.
|
|
|
|
JDK-8244460: Support for certificate_authorities Extension
|
|
==========================================================
|
|
The "certificate_authorities" extension is an optional extension
|
|
introduced in TLS 1.3. It is used to indicate the certificate
|
|
authorities (CAs) that an endpoint supports and should be used by the
|
|
receiving endpoint to guide certificate selection.
|
|
|
|
With this JDK release, the "certificate_authorities" extension is
|
|
supported for TLS 1.3 in both the client and the server sides. This
|
|
extension is always present for client certificate selection, while it
|
|
is optional for server certificate selection.
|
|
|
|
Applications can enable this extension for server certificate
|
|
selection by setting the `jdk.tls.client.enableCAExtension` system
|
|
property to `true`. The default value of the property is `false`.
|
|
|
|
Note that if the client trusts more CAs than the size limit of the
|
|
extension (less than 2^16 bytes), the extension is not enabled. Also,
|
|
some server implementations do not allow handshake messages to exceed
|
|
2^14 bytes. Consequently, there may be interoperability issues when
|
|
`jdk.tls.client.enableCAExtension` is set to `true` and the client
|
|
trusts more CAs than the server implementation limit.
|
|
|
|
New in release OpenJDK 8u292 (2021-04-20):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u292
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u292.txt
|
|
|
|
* Security fixes
|
|
- JDK-8227467: Better class method invocations
|
|
- JDK-8244473: Contextualize registration for JNDI
|
|
- JDK-8244543: Enhanced handling of abstract classes
|
|
- JDK-8249906, CVE-2021-2163: Enhance opening JARs
|
|
- JDK-8250568, CVE-2021-2161: Less ambiguous processing
|
|
- JDK-8253799: Make lists of normal filenames
|
|
* Other changes
|
|
- JDK-6345095: regression test EmptyClipRenderingTest fails
|
|
- JDK-6896810: TEST_BUG: java/lang/ref/SoftReference/Pin.java fails with OOME during System.out.println
|
|
- JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/PDialogTest.java needs update by removing a infinite loop
|
|
- JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream readDouble() conversion to long mishandled
|
|
- JDK-7112454: TEST_BUG: java/awt/Choice/PopdownGeneratesMouseEvents/PopdownGeneratesMouseEvents.html failed
|
|
- JDK-7131835: [TEST_BUG] Test does not consider that the rounded edges of the window in Mac OS 10.7
|
|
- JDK-7185221: [macosx] Regtest should not throw exception if a suitable display mode found
|
|
- JDK-8031126: java/lang/management/ThreadMXBean/ThreadUserTime.java fails intermittently
|
|
- JDK-8035166: Remove dependency on EC classes from pkcs11 provider
|
|
- JDK-8035186: j2se_jdk/jdk/test/java/lang/invoke/lambda/LogGeneratedClassesTest.java - assertion error
|
|
- JDK-8038723: Openup some PrinterJob tests
|
|
- JDK-8041464: [TEST_BUG] CustomClassLoaderTransferTest does not support OS X
|
|
- JDK-8041561: Inconsistent opacity behaviour between JCheckBox and JRadioButton
|
|
- JDK-8061777: (zipfs) IllegalArgumentException in ZipCoder.toString when using Shitft_JIS
|
|
- JDK-8078024: javac, several incorporation steps are silently failing when an error should be reported
|
|
- JDK-8078450: Implement consistent process for quarantine of tests
|
|
- JDK-8078614: WindowsClassicLookAndFeel MetalComboBoxUI.getbaseLine fails with IllegalArgumentException
|
|
- JDK-8080953: [TEST_BUG]Test java/awt/FontClass/DebugFonts.java fails due to wrongly typed bugid
|
|
- JDK-8081547: Prepare client libs regression tests for running in a concurrent, headless jtreg environment
|
|
- JDK-8129626: G1: set_in_progress() and clear_started() needs a barrier on non-TSO platforms
|
|
- JDK-8141457: keytool default cert fingerprint algorithm should be SHA-256
|
|
- JDK-8145051: Wrong parameter name in synthetic lambda method leads to verifier error
|
|
- JDK-8150204: (fs) Enhance java/nio/file/Files/probeContentType/Basic.java debugging output
|
|
- JDK-8158525: Update a few java/net tests to use the loopback address instead of the host address
|
|
- JDK-8160217: JavaSound should clean up resources better
|
|
- JDK-8167281: IIOMetadataNode bugs in getElementsByTagName and NodeList.item methods
|
|
- JDK-8168996: C2 crash at postaloc.cpp:140 : assert(false) failed: unexpected yanked node
|
|
- JDK-8171410: aarch64: long multiplyExact shifts by 31 instead of 63
|
|
- JDK-8172404: Tools should warn if weak algorithms are used before restricting them
|
|
- JDK-8185934: keytool shows "Signature algorithm: SHA1withECDSA, -1-bit key"
|
|
- JDK-8191915: JCK tests produce incorrect results with C2
|
|
- JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode
|
|
- JDK-8202343: Disable TLS 1.0 and 1.1
|
|
- JDK-8209333: Socket reset issue for TLS 1.3 socket close
|
|
- JDK-8211301: [macos] support full window content options
|
|
- JDK-8211339: NPE during SSL handshake caused by HostnameChecker
|
|
- JDK-8216987: ciMethodData::load_data() unpacks MDOs with non-atomic copy
|
|
- JDK-8217338: [Containers] Improve systemd slice memory limit support
|
|
- JDK-8219991: New fix of the deadlock in sun.security.ssl.SSLSocketImpl
|
|
- JDK-8221408: Windows 32bit build build errors/warnings in hotspot
|
|
- JDK-8223186: HotSpot compile warnings from GCC 9
|
|
- JDK-8225435: Upgrade IANA Language Subtag Registry to the latest for JDK14
|
|
- JDK-8225805: Java Access Bridge does not close the logger
|
|
- JDK-8226899: Problemlist compiler/rtm tests
|
|
- JDK-8227642: [TESTBUG] Make docker tests podman compatible
|
|
- JDK-8228434: jdk/net/Sockets/Test.java fails after JDK-8227642
|
|
- JDK-8229284: jdk/internal/platform/cgroup/TestCgroupMetrics.java fails for - memory:getMemoryUsage
|
|
- JDK-8230388: Problemlist additional compiler/rtm tests
|
|
- JDK-8233228: Disable weak named curves by default in TLS, CertPath, and Signed JAR
|
|
- JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests support TLSv1.3
|
|
- JDK-8234728: Some security tests should support TLSv1.3
|
|
- JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
|
|
- JDK-8235311: Tag mismatch may alert bad_record_mac
|
|
- JDK-8235874: The ordering of Cipher Suites is not maintained provided through jdk.tls.client.cipherSuites and jdk.tls.server.cipherSuites system property.
|
|
- JDK-8236500: Windows ucrt.dll should be looked up in versioned WINSDK subdirectory
|
|
- JDK-8238579: HttpsURLConnection drops the timeout and hangs forever in read
|
|
- JDK-8239091: Reversed arguments in call to strstr in freetype "debug" code.
|
|
- JDK-8240353: AArch64: missing support for -XX:+ExtendedDTraceProbes in C1
|
|
- JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use fiber-friendly java.util.concurrent.locks in JSSE"
|
|
- JDK-8242141: New System Properties to configure the TLS signature schemes
|
|
- JDK-8244621: [macos10.15] Garbled FX printing plus CoreText warnings on Catalina when building with Xcode 11
|
|
- JDK-8248336: AArch64: C2: offset overflow in BoxLockNode::emit
|
|
- JDK-8249183: JVM crash in "AwtFrame::WmSize" method
|
|
- JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is not highlighted in GTKLookAndFeel
|
|
- JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
|
|
- JDK-8250582: Revert Principal Name type to NT-UNKNOWN when requesting TGS Kerberos tickets
|
|
- JDK-8250984: Memory Docker tests fail on some Linux kernels w/o cgroupv1 swap limit capabilities
|
|
- JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
|
|
- JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails on Windows
|
|
- JDK-8253368: TLS connection always receives close_notify exception
|
|
- JDK-8253476: TestUseContainerSupport.java fails on some Linux kernels w/o swap limit capabilities
|
|
- JDK-8253932: SSL debug log prints incorrect caller info
|
|
- JDK-8254854: [cgroups v1] Metric limits not properly detected on some join controller combinations
|
|
- JDK-8255880: UI of Swing components is not redrawn after their internal state changed
|
|
- JDK-8255908: ExceptionInInitializerError due to UncheckedIOException while initializing cgroupv1 subsystem
|
|
- JDK-8255937: Better cleanup for test/jdk/javax/imageio/stream/StreamFlush.java
|
|
- JDK-8256421: Add 2 HARICA roots to cacerts truststore
|
|
- JDK-8256642: [TEST_BUG] jdk/test/javax/sound/midi/MidiSystem/DefaultProperties.java failed
|
|
- JDK-8258079: Eliminate ParNew's use of klass_or_null()
|
|
- JDK-8256682: JDK-8202343 is incomplete
|
|
- JDK-8257746: Regression introduced with JDK-8250984 - memory might be null in some machines
|
|
- JDK-8258241: [8u] Missing doPrivileged() hunks from JDK-8226575
|
|
- JDK-8258247: Couple of issues in fix for JDK-8249906
|
|
- JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder.rotateDisk()
|
|
- JDK-8258430: 8u backport of JDK-8063107 missing test/javax/swing/JRadioButton/8041561/bug8041561.java changes
|
|
- JDK-8258833: Cancel multi-part cipher operations in SunPKCS11 after failures
|
|
- JDK-8258933: G1 needs klass_or_null_acquire
|
|
- JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
|
|
- JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will
|
|
- JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
|
|
- JDK-8259428: AlgorithmId.getEncodedParams() should return copy
|
|
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
|
|
- JDK-8260349: Cannot programmatically retrieve Metaspace max set via JAVA_TOOL_OPTIONS
|
|
- JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
|
|
- JDK-8260930: AARCH64: Invalid value passed to critical JNI function
|
|
- JDK-8261183: Follow on to Make lists of normal filenames
|
|
- JDK-8261231: Windows IME was disabled after DnD operation
|
|
- JDK-8261766: [8u] hotspot needs to recognise cl.exe 19.16 to build with VS2017
|
|
- JDK-8262073: assert(allocates2(pc)) failed: not in CodeBuffer memory
|
|
- JDK-8262075: sun/security/krb5/auto/UseCacheAndStoreKey.java timed out intermittently
|
|
- JDK-8263008: AARCH64: Add debug info for libsaproc.so
|
|
- JDK-8264171: Missing aarch64 parts of JDK-8236179 (C1 register allocation failure with T_ADDRESS)
|
|
* Shenandoah
|
|
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in 8u292-b01.
|
|
- Revert differences against upstream 8u
|
|
- [backport] 8202976: Add C1 lea patching support for x86
|
|
- [backport] 8221507: Implement JFR Events for Shenandoah
|
|
- [backport] 8224573: Fix windows build after JDK-8221507
|
|
- [backport] 8228369: Shenandoah: Refactor LRB C1 stubs
|
|
- [backport] 8229474: Shenandoah: Cleanup CM::update_roots()
|
|
- [backport] 8229709: x86_32 build and test failures after JDK-8228369 (Shenandoah: Refactor LRB C1 stubs)
|
|
- [backport] 8231087: Shenandoah: Self-fixing load reference barriers for C1/C2
|
|
- [backport] 8232747: Shenandoah: Concurrent GC should deactivate SATB before processing weak roots
|
|
- [backport] 8232992: Shenandoah: Implement self-fixing interpreter LRB
|
|
- [backport] 8233021: Shenandoah: SBSC2::is_shenandoah_lrb_call should match all LRB shapes
|
|
- [backport] 8233165: Shenandoah:SBSA::gen_load_reference_barrier_stub() should use pointer register for address on aarch64
|
|
- [backport] 8233574: Shenandoah: build is broken without jfr
|
|
- [backport] 8237837: Shenandoah: assert(mem == __null) failed: only one safepoint
|
|
- [backport] 8238153: CTW: C2 (Shenandoah) compilation fails with "Unknown node in get_load_addr: CreateEx"
|
|
- [backport] 8238851: Shenandoah: C1: Resolve into registers of correct type
|
|
- [backport] 8240315: Shenandoah: Rename ShLBN::get_barrier_strength()
|
|
- [backport] 8240751: Shenandoah: fold ShenandoahTracer definition
|
|
- [backport] 8241765: Shenandoah: AARCH64 need to save/restore call clobbered registers before calling keepalive barrier
|
|
- [backport] 8244510: Shenandoah: invert SHC2Support::is_in_cset condition
|
|
- [backport] 8244663: Shenandoah: C2 assertion fails in Matcher::collect_null_checks
|
|
- [backport] 8244721: CTW: C2 (Shenandoah) compilation fails with "unexpected infinite loop graph shape"
|
|
- [backport] 8251451: Shenandoah: Remark ObjectSynchronizer roots with I-U
|
|
- [backport] 8252660: Shenandoah: support manageable SoftMaxHeapSize option
|
|
- [backport] 8253224: Shenandoah: ShenandoahStrDedupQueue destructor calls virtual num_queues()
|
|
- [backport] 8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint should not access VMThread state from other threads
|
|
- [backport] 8255457: Shenandoah: cleanup ShenandoahMarkTask
|
|
- [backport] 8255760: Shenandoah: match constants style in ShenandoahMarkTask fallback
|
|
- [backport] 8256806: Shenandoah: optimize shenandoah/jni/TestPinnedGarbage.java test
|
|
- [backport] 8257641: Shenandoah: Query is_at_shenandoah_safepoint() from control thread should return false
|
|
- Fix register allocation for thread register is 32bit LRB
|
|
- Fix Shenandoah bindings in ADLC formssel
|
|
- Shenandoah: Backed out weak roots cleaning during full gc
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
security-libs/java.security:
|
|
|
|
JDK-8260597: Added 2 HARICA Root CA Certificates
|
|
================================================
|
|
|
|
The following root certificates have been added to the cacerts truststore:
|
|
|
|
Alias Name: haricarootca2015
|
|
Distinguished Name: CN=Hellenic Academic and Research Institutions RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR
|
|
|
|
Alias Name: haricaeccrootca2015
|
|
Distinguished Name: CN=Hellenic Academic and Research Institutions ECC RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR
|
|
|
|
JDK-8236730: Weak Named Curves in TLS, CertPath, and Signed JAR Disabled by Default
|
|
===================================================================================
|
|
Weak named curves are disabled by default by adding them to the
|
|
following `disabledAlgorithms` security properties:
|
|
|
|
* jdk.tls.disabledAlgorithms
|
|
* jdk.certpath.disabledAlgorithms
|
|
* jdk.jar.disabledAlgorithms
|
|
|
|
Red Hat has always disabled many of the curves provided by upstream,
|
|
so the only addition in this release is:
|
|
|
|
* secp256k1
|
|
|
|
The curves that remain enabled are:
|
|
|
|
* secp256r1
|
|
* secp384r1
|
|
* secp521r1
|
|
* X25519
|
|
* X448
|
|
|
|
When large numbers of weak named curves need to be disabled, adding
|
|
individual named curves to each `disabledAlgorithms` property would be
|
|
overwhelming. To relieve this, a new security property,
|
|
`jdk.disabled.namedCurves`, is implemented that can list the named
|
|
curves common to all of the `disabledAlgorithms` properties. To use
|
|
the new property in the `disabledAlgorithms` properties, precede the
|
|
full property name with the keyword `include`. Users can still add
|
|
individual named curves to `disabledAlgorithms` properties separate
|
|
from this new property. No other properties can be included in the
|
|
`disabledAlgorithms` properties.
|
|
|
|
To restore the named curves, remove the `include
|
|
jdk.disabled.namedCurves` either from specific or from all
|
|
`disabledAlgorithms` security properties. To restore one or more
|
|
curves, remove the specific named curve(s) from the
|
|
`jdk.disabled.namedCurves` property.
|
|
|
|
JDK-8244286: Tools Warn If Weak Algorithms Are Used
|
|
===================================================
|
|
The `keytool` and `jarsigner` tools have been updated to warn users
|
|
when weak cryptographic algorithms are used in keys, certificates, and
|
|
signed JARs before they are disabled. The weak algorithms are set in
|
|
the `jdk.security.legacyAlgorithms` security property in the
|
|
`java.security` configuration file. In this release, the tools issue
|
|
warnings for the SHA-1 hash algorithm and 1024-bit RSA/DSA keys.
|
|
|
|
security-libs/javax.net.ssl:
|
|
|
|
JDK-8256490: Disable TLS 1.0 and 1.1
|
|
====================================
|
|
TLS 1.0 and 1.1 are versions of the TLS protocol that are no longer
|
|
considered secure and have been superseded by more secure and modern
|
|
versions (TLS 1.2 and 1.3).
|
|
|
|
These versions have now been disabled by default. If you encounter
|
|
issues, you can, at your own risk, re-enable the versions by removing
|
|
"TLSv1" and/or "TLSv1.1" from the `jdk.tls.disabledAlgorithms`
|
|
security property in the `java.security` configuration file.
|
|
|
|
JDK-8242147: New System Properties to Configure the TLS Signature Schemes
|
|
=========================================================================
|
|
Two new system properties have been added to customize the TLS
|
|
signature schemes in JDK. `jdk.tls.client.SignatureSchemes` has been
|
|
added for the TLS client side, and `jdk.tls.server.SignatureSchemes`
|
|
has been added for the server side.
|
|
|
|
Each system property contains a comma-separated list of supported
|
|
signature scheme names specifying the signature schemes that could be
|
|
used for the TLS connections.
|
|
|
|
The names are described in the "Signature Schemes" section of the
|
|
*Java Security Standard Algorithm Names Specification*.
|
|
|
|
tools/javac:
|
|
|
|
JDK-8177368: Several incorporation steps are silently failing when an error should be reported
|
|
==============================================================================================
|
|
Reporting previously silent errors found during incorporation, JLS
|
|
8§18.3, was supposed to be a clean-up with performance only
|
|
implications. But consider the test case:
|
|
|
|
import java.util.Arrays;
|
|
import java.util.List;
|
|
|
|
class Klass {
|
|
public static <A> List<List<A>> foo(List<? extends A>... lists) {
|
|
return foo(Arrays.asList(lists));
|
|
}
|
|
|
|
public static <B> List<List<B>> foo(List<? extends List<? extends B>> lists) {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
This code was not accepted before the patch for [1], but after this
|
|
patch the compiler is accepting it. Accepting this code is the right
|
|
behavior as not reporting incorporation errors was a bug in the
|
|
compiler. While determining the applicability of method: <B>
|
|
List<List<B>> foo(List<? extends List<? extends B>> lists) for which
|
|
we have the constraints: b <: Object t <: List<? extends B> t<:Object
|
|
List<? extends A> <: t first, inference variable b is selected for
|
|
instantiation: b = CAP1 of ? extends A so this implies that: t <:
|
|
List<? extends CAP1 of ? extends A> t<: Object List<? extends A> <: t
|
|
|
|
Now all the bounds are checked for consistency. While checking if
|
|
List<? extends A> is a subtype of List<? extends CAP1 of ? extends A>
|
|
a bound error is reported. Before the compiler was just swallowing
|
|
it. As now the error is reported while inference variable b is being
|
|
instantiated, the bound set is rolled back to it's initial state, 'b'
|
|
is instantiated to Object, and with this instantiation the constraint
|
|
set is solvable, the method is applicable, it's the only applicable
|
|
one and the code is accepted as correct. The compiler behavior in this
|
|
case is defined at JLS 8 §18.4
|
|
|
|
This fix has source compatibility impact, right now code that wasn't
|
|
being accepted is now being accepted by the javac compiler. Currently
|
|
there are no reports of any other kind of incompatibility.
|
|
|
|
[1] https://bugs.openjdk.java.net/browse/JDK-8078024
|
|
|
|
New in release OpenJDK 8u282 (2021-01-19):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u282
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u282.txt
|
|
|
|
* Security fixes
|
|
- JDK-8247619: Improve Direct Buffering of Characters
|
|
* Other changes
|
|
- JDK-6962725: Regtest javax/swing/JFileChooser/6738668/bug6738668.java fails under Linux
|
|
- JDK-8008657: JSpinner setComponentOrientation doesn't affect on text orientation
|
|
- JDK-8022535: [TEST BUG] javax/swing/text/html/parser/Test8017492.java fails
|
|
- JDK-8025936: Windows .pdb and .map files does not have proper dependencies setup
|
|
- JDK-8030350: Enable additional compiler warnings for GCC
|
|
- JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails by Timeout on Windows
|
|
- JDK-8036122: Fix warning 'format not a string literal'
|
|
- JDK-8039279: Move awt tests to openjdk repository
|
|
- JDK-8041592: [TEST_BUG] Move 42 AWT hw/lw mixing tests to jdk
|
|
- JDK-8043126: move awt automated functional tests from AWT_Events/Lw and AWT_Events/AWT to OpenJDK repository
|
|
- JDK-8043131: Move ShapedAndTranslucentWindows and GC functional AWT tests to regression tree
|
|
- JDK-8043899: compiler/5091921/Test7005594.java fails if specified -Xmx is less than 1600m
|
|
- JDK-8044157: [TEST_BUG] Improve recently submitted AWT_Mixing tests
|
|
- JDK-8044172: [TEST_BUG] Move regtests for 4523758 and AltPlusNumberKeyCombinationsTest to jdk
|
|
- JDK-8044429: move awt automated tests for AWT_Modality to OpenJDK repository
|
|
- JDK-8044765: Move functional tests AWT_SystemTray/Automated to openjdk repository
|
|
- JDK-8046221: [TEST_BUG] Cleanup datatransfer tests
|
|
- JDK-8047180: Move functional tests AWT_Headless/Automated to OpenJDK repository
|
|
- JDK-8047367: move awt automated tests from AWT_Modality to OpenJDK repository - part 2
|
|
- JDK-8048246: Move AWT_DnD/Clipboard/Automated functional tests to OpenJDK
|
|
- JDK-8049617: move awt automated tests from AWT_Modality to OpenJDK repository - part 3
|
|
- JDK-8049694: Migrate functional AWT_DesktopProperties/Automated tests to OpenJDK
|
|
- JDK-8050885: move awt automated tests from AWT_Modality to OpenJDK repository - part 4
|
|
- JDK-8051440: move tests about maximizing undecorated to OpenJDK
|
|
- JDK-8051853: new URI("x/").resolve("..").getSchemeSpecificPart() returns null!
|
|
- JDK-8052012: move awt automated tests from AWT_Modality to OpenJDK repository - part 5
|
|
- JDK-8052408: Move AWT_BAT functional tests to OpenJDK (3 of 3)
|
|
- JDK-8053657: [TEST_BUG] move some 5 tests related to undecorated Frame/JFrame to JDK
|
|
- JDK-8054143: move awt automated tests from AWT_Modality to OpenJDK repository - part 6
|
|
- JDK-8054358: move awt automated tests from AWT_Modality to OpenJDK repository - part 7
|
|
- JDK-8054359: move awt automated tests from AWT_Modality to OpenJDK repository - part 8
|
|
- JDK-8055360: Move the rest part of AWT ShapedAndTranslucent tests to OpenJDK
|
|
- JDK-8055664: move 14 tests about setLocationRelativeTo to jdk
|
|
- JDK-8055836: move awt tests from AWT_Modality to OpenJDK repository - part 9
|
|
- JDK-8057694: move awt tests from AWT_Modality to OpenJDK repository - part 10
|
|
- JDK-8058805: [TEST_BUG]Test java/awt/TrayIcon/SecurityCheck/NoPermissionTest/NoPermissionTest.java fails
|
|
- JDK-8062808: Turn on the -Wreturn-type warning
|
|
- JDK-8063102: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 1
|
|
- JDK-8063104: Change open awt regression tests to avoid sun.awt.SunToolkit.realSync, part 2
|
|
- JDK-8063106: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 1
|
|
- JDK-8063107: Change open swing regression tests to avoid sun.awt.SunToolkit.realSync, part 2
|
|
- JDK-8064573: [TEST_BUG] javax/swing/text/AbstractDocument/6968363/Test6968363.java is asocial pressing VK_LEFT and not releasing
|
|
- JDK-8064575: [TEST_BUG] javax/swing/JEditorPane/6917744/bug6917744.java 100 times press keys and never releases
|
|
- JDK-8064809: [TEST_BUG] javax/swing/JComboBox/4199622/bug4199622.java contains a lot of keyPress and not a single keyRelease
|
|
- JDK-8067441: Some tests fails with error: cannot find symbol getSystemMnemonicKeyCodes()
|
|
- JDK-8068228: Test closed/java/awt/Mouse/MaximizedFrameTest/MaximizedFrameTest fails with GTKLookAndFeel
|
|
- JDK-8068275: Some tests failed after JDK-8063104
|
|
- JDK-8069211: (zipfs) ZipFileSystem creates corrupted zip if entry output stream gets closed more than once
|
|
- JDK-8074807: Fix some tests unnecessary using internal API
|
|
- JDK-8076315: move 4 manual functional swing tests to regression suite
|
|
- JDK-8130772: Util.hitMnemonics does not work: getSystemMnemonicKeyCodes() returns ALT_MASK rather than VK_ALT
|
|
- JDK-8132664: closed/javax/swing/DataTransfer/DefaultNoDrop/DefaultNoDrop.java locks on Windows
|
|
- JDK-8134632: Mark javax/sound/midi/Devices/InitializationHang.java as headful
|
|
- JDK-8148854: Class names "SomeClass" and "LSomeClass;" treated by JVM as an equivalent
|
|
- JDK-8148916: Mark bug6400879.java as intermittently failing
|
|
- JDK-8148983: Fix extra comma in changes for JDK-8148916
|
|
- JDK-8152545: Use preprocessor instead of compiling a program to generate native nio constants
|
|
- JDK-8156803: Turn StressLCM/StressGCM flags to diagnostic
|
|
- JDK-8160438: javax/swing/plaf/nimbus/8057791/bug8057791.java fails
|
|
- JDK-8160761: [TESTBUG] Several compiler tests fail with product bits
|
|
- JDK-8163161: [PIT][TEST_BUG] increase timeout in javax/swing/plaf/nimbus/8057791/bug8057791.java
|
|
- JDK-8165808: Add release barriers when allocating objects with concurrent collection
|
|
- JDK-8166015: [PIT][TEST_BUG] stray character in java/awt/Focus/ModalDialogActivationTest/ModalDialogActivationTest.java
|
|
- JDK-8166583: Add oopDesc::klass_or_null_acquire()
|
|
- JDK-8166663: Simplify oops_on_card_seq_iterate_careful
|
|
- JDK-8166862: CMS needs klass_or_null_acquire
|
|
- JDK-8168292: [TESTBUG] [macosx] Test java/awt/TrayIcon/DragEventSource/DragEventSource.java fails on OS X
|
|
- JDK-8168682: jdk/test/java/lang/ClassLoader/forNameLeak/ClassForNameLeak.java fails with -Xcomp
|
|
- JDK-8179083: Uninitialized notifier in Java Monitor Wait tracing event
|
|
- JDK-8185003: JMX: Add a version of ThreadMXBean.dumpAllThreads with a maxDepth argument
|
|
- JDK-8197981: Missing return statement in __sync_val_compare_and_swap_8
|
|
- JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java on windows with VS2017
|
|
- JDK-8205507: jdk/javax/xml/crypto/dsig/GenerationTests.java timed out
|
|
- JDK-8207766: [testbug] Adapt tests for Aix.
|
|
- JDK-8212070: Introduce diagnostic flag to abort VM on failed JIT compilation
|
|
- JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash
|
|
- JDK-8215727: Restore JFR thread sampler loop to old / previous behavior
|
|
- JDK-8217362: Emergency dump does not work when disk=false is set
|
|
- JDK-8217766: Container Support doesn't work for some Join Controllers combinations
|
|
- JDK-8219013: Update Apache Santuario (XML Signature) to version 2.1.3
|
|
- JDK-8219562: Line of code in osContainer_linux.cpp L102 appears unreachable
|
|
- JDK-8220579: [Containers] SubSystem.java out of sync with osContainer_linux.cpp
|
|
- JDK-8220657: JFR.dump does not work when filename is set
|
|
- JDK-8221340: [TESTBUG] TestCgroupMetrics.java fails after fix for JDK-8219562
|
|
- JDK-8221342: [TESTBUG] Generate Dockerfile for docker testing
|
|
- JDK-8221710: [TESTBUG] more configurable parameters for docker testing
|
|
- JDK-8223108: Test java/awt/EventQueue/NonComponentSourcePost.java is unstable
|
|
- JDK-8224502: [TESTBUG] JDK docker test TestSystemMetrics.java fails with access issues and OOM
|
|
- JDK-8225072: Add LuxTrust certificate that is expiring in March 2021 to list of allowed but expired certs
|
|
- JDK-8227006: [linux] Runtime.availableProcessors execution time increased by factor of 100
|
|
- JDK-8229868: Update Apache Santuario TPRM version
|
|
- JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes() can be quicker for self thread
|
|
- JDK-8231968: getCurrentThreadAllocatedBytes default implementation s/b getThreadAllocatedBytes
|
|
- JDK-8232114: JVM crashed at imjpapi.dll in native code
|
|
- JDK-8233548: Update CUP to v0.11b
|
|
- JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect numbers for Compiler area
|
|
- JDK-8234339: replace JLI_StrTok in java_md_solinux.c
|
|
- JDK-8238448: RSASSA-PSS signature verification fail when using certain odd key sizes
|
|
- JDK-8239105: Add exception for expiring Digicert root certificates to VerifyCACerts test
|
|
- JDK-8242335: Additional Tests for RSASSA-PSS
|
|
- JDK-8242480: Negative value may be returned by getFreeSwapSpaceSize() in the docker
|
|
- JDK-8244225: stringop-overflow warning on strncpy call from compile_the_world_in
|
|
- JDK-8245400: Upgrade to LittleCMS 2.11
|
|
- JDK-8246648: issue with OperatingSystemImpl getFreeSwapSpaceSize in docker after 8242480
|
|
- JDK-8248214: Add paddings for TaskQueueSuper to reduce false-sharing cache contention
|
|
- JDK-8249176: Update GlobalSignR6CA test certificates
|
|
- JDK-8249846: Change of behavior after JDK-8237117: Better ForkJoinPool behavior
|
|
- JDK-8250636: iso8601_time returns incorrect offset part on MacOS
|
|
- JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY
|
|
- JDK-8250928: JFR: Improve hash algorithm for stack traces
|
|
- JDK-8251365: Build failure on AIX after 8250636
|
|
- JDK-8251469: Better cleanup for test/jdk/javax/imageio/SetOutput.java
|
|
- JDK-8251840: Java_sun_awt_X11_XToolkit_getDefaultScreenData should not be in make/mapfiles/libawt_xawt/mapfile-vers
|
|
- JDK-8252384: [TESTBUG] Some tests refer to COMPAT provider rather than JRE
|
|
- JDK-8252395: [8u] --with-native-debug-symbols=external doesn't include debuginfo files for binaries
|
|
- JDK-8252497: Incorrect numeric currency code for ROL
|
|
- JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent
|
|
- JDK-8252904: VM crashes when JFR is used and JFR event class is transformed
|
|
- JDK-8252975: [8u] JDK-8252395 breaks the build for --with-native-debug-symbols=internal
|
|
- JDK-8253036: Support building the Zero assembler port on AArch64
|
|
- JDK-8253284: Zero OrderAccess barrier mappings are incorrect
|
|
- JDK-8253550: [8u] JDK-8252395 breaks the build for make STRIP_POLICY=no_strip
|
|
- JDK-8253752: test/sun/management/jmxremote/bootstrap/RmiBootstrapTest.java fails randomly
|
|
- JDK-8253837: JFR 8u fix symbol and cstring hashtable equals implementaion
|
|
- JDK-8254081: java/security/cert/PolicyNode/GetPolicyQualifiers.java fails due to an expired certificate
|
|
- JDK-8254144: Non-x86 Zero builds fail with return-type warning in os_linux_zero.cpp
|
|
- JDK-8254166: Zero: return-type warning in zeroInterpreter_zero.cpp
|
|
- JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/WorkerDeadlockTest.java fails
|
|
- JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
|
|
- JDK-8255003: Build failures on Solaris
|
|
- JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
|
|
- JDK-8255269: Unsigned overflow in g1Policy.cpp
|
|
- JDK-8255603: Memory/Performance regression after JDK-8210985
|
|
- JDK-8255717: Fix JFR crash in WriteObjectSampleStacktrace due to object not initialized
|
|
- JDK-8256618: Zero: Linux x86_32 build still fails
|
|
- JDK-8256671: Incorrect assignment operator used in guarantee() in genCollectedHeap
|
|
- JDK-8256752: 8252395 incorrect copy rule for macos .dSYM folder
|
|
- JDK-8257397: [TESTBUG] test/lib/containers/docker/Common.java refers to -Xlog:os+container=trace
|
|
- JDK-8258630: Add expiry exception for QuoVadis root certificate
|
|
* AArch64 port
|
|
- Fix AArch64 build failure after JDK-8062808 backport
|
|
* Shenandoah
|
|
- Fix racy update of code roots
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
security-libs/javax.xml.crypto:
|
|
|
|
JDK-8230839: Updated XML Signature Implementation to Apache Santuario 2.1.3
|
|
===========================================================================
|
|
The XML Signature implementation in the `java.xml.crypto` module has
|
|
been updated to version 2.1.3 of Apache Santuario. New features
|
|
include:
|
|
|
|
* Added support for embedding elliptic curve public keys in the
|
|
KeyValue element
|
|
|
|
New in release OpenJDK 8u275 (2020-11-05):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u275
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u275.txt
|
|
|
|
* Regression fixes
|
|
- JDK-8214440: ldap over a TLS connection negotiate failed with "javax.net.ssl.SSLPeerUnverifiedException: hostname of the server '' does not match the hostname in the server's certificate"
|
|
- JDK-8223940: Private key not supported by chosen signature algorithm
|
|
- JDK-8236512: PKCS11 Connection closed after Cipher.doFinal and NoPadding
|
|
- JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
|
|
|
|
New in release OpenJDK 8u272 (2020-10-20):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u272
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u272.txt
|
|
|
|
* New features
|
|
- JDK-8245468: Add TLSv1.3 implementation classes from 11.0.7
|
|
* Security fixes
|
|
- JDK-8233624: Enhance JNI linkage
|
|
- JDK-8236196: Improve string pooling
|
|
- JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
|
|
- JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
|
|
- JDK-8237995, CVE-2020-14782: Enhance certificate processing
|
|
- JDK-8240124: Better VM Interning
|
|
- JDK-8241114, CVE-2020-14792: Better range handling
|
|
- JDK-8242680, CVE-2020-14796: Improved URI Support
|
|
- JDK-8242685, CVE-2020-14797: Better Path Validation
|
|
- JDK-8242695, CVE-2020-14798: Enhanced buffer support
|
|
- JDK-8243302: Advanced class supports
|
|
- JDK-8244136, CVE-2020-14803: Improved Buffer supports
|
|
- JDK-8244479: Further constrain certificates
|
|
- JDK-8244955: Additional Fix for JDK-8240124
|
|
- JDK-8245407: Enhance zoning of times
|
|
- JDK-8245412: Better class definitions
|
|
- JDK-8245417: Improve certificate chain handling
|
|
- JDK-8248574: Improve jpeg processing
|
|
- JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
|
|
- JDK-8253019: Enhanced JPEG decoding
|
|
* Other changes
|
|
- JDK-6574989: TEST_BUG: javax/sound/sampled/Clip/bug5070081.java fails sometimes
|
|
- JDK-8006205: [TESTBUG] NEED_TEST: please JTREGIFY test/compiler/7177917/Test7177917.java
|
|
- JDK-8023697: failed class resolution reports different class name in detail message for the first and subsequent times
|
|
- JDK-8025886: replace [[ and == bash extensions in regtest
|
|
- JDK-8026236: Add PrimeTest for BigInteger
|
|
- JDK-8031625: javadoc problems referencing inner class constructors
|
|
- JDK-8035493: JVMTI PopFrame capability must instruct compilers not to prune locals
|
|
- JDK-8036088: Replace strtok() with its safe equivalent strtok_s() in DefaultProxySelector.c
|
|
- JDK-8039082: [TEST_BUG] Test java/awt/dnd/BadSerializationTest/BadSerializationTest.java fails
|
|
- JDK-8046274: Removing dependency on jakarta-regexp
|
|
- JDK-8048933: -XX:+TraceExceptions output should include the message
|
|
- JDK-8057003: Large reference arrays cause extremely long synchronization times
|
|
- JDK-8060721: Test runtime/SharedArchiveFile/LimitSharedSizes.java fails in jdk 9 fcs new platforms/compiler
|
|
- JDK-8061616: HotspotDiagnosticMXBean.getVMOption() throws IllegalArgumentException for flags of type double
|
|
- JDK-8062947: Fix exception message to correctly represent LDAP connection failure
|
|
- JDK-8064319: Need to enable -XX:+TraceExceptions in release builds
|
|
- JDK-8075774: Small readability and performance improvements for zipfs
|
|
- JDK-8076151: [TESTBUG] Test java/awt/FontClass/CreateFont/fileaccess/FontFile.java fails
|
|
- JDK-8078334: Mark regression tests using randomness
|
|
- JDK-8078880: Mark a few more intermittently failuring security-libs
|
|
- JDK-8080462: Update SunPKCS11 provider with PKCS11 v2.40 support
|
|
- JDK-8132206: move ScanTest.java into OpenJDK
|
|
- JDK-8132376: Add @requires os.family to the client tests with access to internal OS-specific API
|
|
- JDK-8132745: minor cleanup of java/util/Scanner/ScanTest.java
|
|
- JDK-8137087: [TEST_BUG] Cygwin failure of java/awt/appletviewer/IOExceptionIfEncodedURLTest/IOExceptionIfEncodedURLTest.sh
|
|
- JDK-8144539: Update PKCS11 tests to run with security manager
|
|
- JDK-8145808: java/awt/Graphics2D/MTGraphicsAccessTest/MTGraphicsAccessTest.java hangs on Win. 8
|
|
- JDK-8148754: C2 loop unrolling fails due to unexpected graph shape
|
|
- JDK-8148854: Class names "SomeClass" and "LSomeClass;" treated by JVM as an equivalent
|
|
- JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect
|
|
- JDK-8151788: NullPointerException from ntlm.Client.type3
|
|
- JDK-8151834: Test SmallPrimeExponentP.java times out intermittently
|
|
- JDK-8152077: (cal) Calendar.roll does not always roll the hours during daylight savings
|
|
- JDK-8153430: jdk regression test MletParserLocaleTest, ParserInfiniteLoopTest reduce default timeout
|
|
- JDK-8153583: Make OutputAnalyzer.reportDiagnosticSummary public
|
|
- JDK-8154313: Generated javadoc scattered all over the place
|
|
- JDK-8156169: Some sound tests rarely hangs because of incorrect synchronization
|
|
- JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider
|
|
- JDK-8161973: PKIXRevocationChecker.getSoftFailExceptions() not working
|
|
- JDK-8163251: Hard coded loop limit prevents reading of smart card data greater than 8k
|
|
- JDK-8165936: Potential Heap buffer overflow when seaching timezone info files
|
|
- JDK-8165996: PKCS11 using NSS throws an error regarding secmod.db when NSS uses sqlite
|
|
- JDK-8166148: Fix for JDK-8165936 broke solaris builds
|
|
- JDK-8167300: Scheduling failures during gcm should be fatal
|
|
- JDK-8167615: Opensource unit/regression tests for JavaSound
|
|
- JDK-8168517: java/lang/ProcessBuilder/Basic.java failed
|
|
- JDK-8169925: PKCS #11 Cryptographic Token Interface license
|
|
- JDK-8172012: [TEST_BUG] delays needed in javax/swing/JTree/4633594/bug4633594.java
|
|
- JDK-8173300: [TESTBUG]compiler/tiered/NonTieredLevelsTest.java fails with compiler.whitebox.SimpleTestCaseHelper(int) must be compiled
|
|
- JDK-8177334: Update xmldsig implementation to Apache Santuario 2.1.1
|
|
- JDK-8177628: Opensource unit/regression tests for ImageIO
|
|
- JDK-8183341: Better cleanup for javax/imageio/AllowSearch.java
|
|
- JDK-8183349: Better cleanup for jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java and WriteAfterAbort.java
|
|
- JDK-8183351: Better cleanup for jdk/test/javax/imageio/spi/AppletContextTest/BadPluginConfigurationTest.sh
|
|
- JDK-8184762: ZapStackSegments should use optimized memset
|
|
- JDK-8191678: [TESTBUG] Add keyword headful in java/awt FocusTransitionTest test.
|
|
- JDK-8192953: sun/management/jmxremote/bootstrap/*.sh tests fail with error : revokeall.exe: Permission denied
|
|
- JDK-8193137: Nashorn crashes when given an empty script file
|
|
- JDK-8193234: When using -Xcheck:jni an internally allocated buffer can leak
|
|
- JDK-8194298: Add support for per Socket configuration of TCP keepalive
|
|
- JDK-8198004: javax/swing/JFileChooser/6868611/bug6868611.java throws error
|
|
- JDK-8200313: java/awt/Gtk/GtkVersionTest/GtkVersionTest.java fails
|
|
- JDK-8201633: Problems with AES-GCM native acceleration
|
|
- JDK-8203357: Container Metrics
|
|
- JDK-8209113: Use WeakReference for lastFontStrike for created Fonts
|
|
- JDK-8210147: adjust some WSAGetLastError usages in windows network coding
|
|
- JDK-8211049: Second parameter of "initialize" method is not used
|
|
- JDK-8211163: UNIX version of Java_java_io_Console_echo does not return a clean boolean
|
|
- JDK-8211714: Need to update vm_version.cpp to recognise VS2017 minor versions
|
|
- JDK-8214862: assert(proj != __null) at compile.cpp:3251
|
|
- JDK-8216283: Allow shorter method sampling interval than 10 ms
|
|
- JDK-8217606: LdapContext#reconnect always opens a new connection
|
|
- JDK-8217647: JFR: recordings on 32-bit systems unreadable
|
|
- JDK-8217878: ENVELOPING XML signature no longer works in JDK 11
|
|
- JDK-8218629: XML Digital Signature throws NAMESPACE_ERR exception on OpenJDK 11, works 8/9/10
|
|
- JDK-8219566: JFR did not collect call stacks when MaxJavaStackTraceDepth is set to zero
|
|
- JDK-8219919: RuntimeStub name lost with PrintFrameConverterAssembly
|
|
- JDK-8220165: Encryption using GCM results in RuntimeException- input length out of bound
|
|
- JDK-8220313: [TESTBUG] Update base image for Docker testing to OL 7.6
|
|
- JDK-8220555: JFR tool shows potentially misleading message when it cannot access a file
|
|
- JDK-8220674: [TESTBUG] MetricsMemoryTester failcount test in docker container only works with debug JVMs
|
|
- JDK-8221569: JFR tool produces incorrect output when both --categories and --events are specified
|
|
- JDK-8222079: Don't use memset to initialize fields decode_env constructor in disassembler.cpp
|
|
- JDK-8224217: RecordingInfo should use textual representation of path
|
|
- JDK-8225695: 32-bit build failures after JDK-8080462 (Update SunPKCS11 provider with PKCS11 v2.40 support)
|
|
- JDK-8226575: OperatingSystemMXBean should be made container aware
|
|
- JDK-8226697: Several tests which need the @key headful keyword are missing it.
|
|
- JDK-8226809: Circular reference in printed stack trace is not correctly indented & ambiguous
|
|
- JDK-8228835: Memory leak in PKCS11 provider when using AES GCM
|
|
- JDK-8229378: jdwp library loader in linker_md.c quietly truncates on buffer overflow
|
|
- JDK-8230303: JDB hangs when running monitor command
|
|
- JDK-8230711: ConnectionGraph::unique_java_object(Node* N) return NULL if n is not in the CG
|
|
- JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
|
|
- JDK-8231779: crash HeapWord*ParallelScavengeHeap::failed_mem_allocate
|
|
- JDK-8233097: Fontmetrics for large Fonts has zero width
|
|
- JDK-8233621: Mismatch in jsse.enableMFLNExtension property name
|
|
- JDK-8234617: C1: Incorrect result of field load due to missing narrowing conversion
|
|
- JDK-8235243: handle VS2017 15.9 and VS2019 in abstract_vm_version
|
|
- JDK-8235325: build failure on Linux after 8235243
|
|
- JDK-8235687: Contents/MacOS/libjli.dylib cannot be a symlink
|
|
- JDK-8236645: JDK 8u231 introduces a regression with incompatible handling of XML messages
|
|
- JDK-8237951: CTW: C2 compilation fails with "malformed control flow"
|
|
- JDK-8238225: Issues reported after replacing symlink at Contents/MacOS/libjli.dylib with binary
|
|
- JDK-8238380: java.base/unix/native/libjava/childproc.c "multiple definition" link errors with GCC10
|
|
- JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c "multiple definition" link errors with GCC10
|
|
- JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link errors with GCC10
|
|
- JDK-8238898: Missing hash characters for header on license file
|
|
- JDK-8239385: KerberosTicket client name refers wrongly to sAMAccountName in AD
|
|
- JDK-8239819: XToolkit: Misread of screen information memory
|
|
- JDK-8240295: hs_err elapsed time in seconds is not accurate enough
|
|
- JDK-8240676: Meet not symmetric failure when running lucene on jdk8
|
|
- JDK-8241888: Mirror jdk.security.allowNonCaAnchor system property with a security one
|
|
- JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads to JVM crash
|
|
- JDK-8242556: Cannot load RSASSA-PSS public key with non-null params from byte array
|
|
- JDK-8243138: Enhance BaseLdapServer to support starttls extended request
|
|
- JDK-8243320: Add SSL root certificates to Oracle Root CA program
|
|
- JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA program
|
|
- JDK-8243489: Thread CPU Load event may contain wrong data for CPU time under certain conditions
|
|
- JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest release 1.8.26
|
|
- JDK-8244818: Java2D Queue Flusher crash while moving application window to external monitor
|
|
- JDK-8245467: Remove 8u TLSv1.2 implementation files
|
|
- JDK-8245469: Remove DTLS protocol implementation
|
|
- JDK-8245470: Fix JDK8 compatibility issues
|
|
- JDK-8245471: Revert JDK-8148188
|
|
- JDK-8245472: Backport JDK-8038893 to JDK8
|
|
- JDK-8245473: OCSP stapling support
|
|
- JDK-8245474: Add TLS_KRB5 cipher suites support according to RFC-2712
|
|
- JDK-8245476: Disable TLSv1.3 protocol in the ClientHello message by default
|
|
- JDK-8245477: Adjust TLS tests location
|
|
- JDK-8245653: Remove 8u TLS tests
|
|
- JDK-8245681: Add TLSv1.3 regression test from 11.0.7
|
|
- JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ
|
|
- JDK-8246310: Clean commented-out code about ModuleEntry andPackageEntry in JFR
|
|
- JDK-8246384: Enable JFR by default on supported architectures for October 2020 release
|
|
- JDK-8248643: Remove extra leading space in JDK-8240295 8u backport
|
|
- JDK-8248851: CMS: Missing memory fences between free chunk check and klass read
|
|
- JDK-8249158: THREAD_START and THREAD_END event posted in primordial phase
|
|
- JDK-8249610: Make sun.security.krb5.Config.getBooleanObject(String... keys) method public
|
|
- JDK-8249677: Regression in 8u after JDK-8237117: Better ForkJoinPool behavior
|
|
- JDK-8250546: Expect changed behaviour reported in JDK-8249846
|
|
- JDK-8250627: Use -XX:+/-UseContainerSupport for enabling/disabling Java container metrics
|
|
- JDK-8250755: Better cleanup for jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java
|
|
- JDK-8250875: Incorrect parameter type for update_number in JDK_Version::jdk_update
|
|
- JDK-8251117: Cannot check P11Key size in P11Cipher and P11AEADCipher
|
|
- JDK-8251120: [8u] HotSpot build assumes ENABLE_JFR is set to either true or false
|
|
- JDK-8251341: Minimal Java specification change
|
|
- JDK-8251478: Backport TLSv1.3 regression tests to JDK8u
|
|
- JDK-8251546: 8u backport of JDK-8194298 breaks AIX and Solaris builds
|
|
- JDK-8252084: Minimal VM fails to bootcycle: undefined symbol: AgeTableTracer::is_tenuring_distribution_event_enabled
|
|
- JDK-8252573: 8u: Windows build failed after 8222079 backport
|
|
- JDK-8252886: [TESTBUG] sun/security/ec/TestEC.java : Compilation failed
|
|
- JDK-8254673: Call to JvmtiExport::post_vm_start() was removed by the fix for JDK-8249158
|
|
- JDK-8254937: Revert JDK-8148854 for 8u272
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
core-svc/java.lang.management:
|
|
|
|
JDK-8236876: OperatingSystemMXBean Methods Inside a Container Return Container Specific Data
|
|
============================================================================================
|
|
When executing in a container, or other virtualized operating
|
|
environment, the following `OperatingSystemMXBean` methods in this
|
|
release return container specific information, if
|
|
available. Otherwise, they return host specific data:
|
|
|
|
* getFreePhysicalMemorySize()
|
|
* getTotalPhysicalMemorySize()
|
|
* getFreeSwapSpaceSize()
|
|
* getTotalSwapSpaceSize()
|
|
* getSystemCpuLoad()
|
|
|
|
security-libs/java.security:
|
|
|
|
JDK-8250756: Added Entrust Root Certification Authority - G4 certificate
|
|
========================================================================
|
|
The Entrust root certificate has been added to the cacerts truststore:
|
|
|
|
Alias Name: entrustrootcag4
|
|
Distinguished Name: CN=Entrust Root Certification Authority - G4, OU="(c) 2015 Entrust, Inc. - for authorized use only", OU=See www.entrust.net/legal-terms, O="Entrust, Inc.", C=US
|
|
|
|
JDK-8250860: Added 3 SSL Corporation Root CA Certificates
|
|
=========================================================
|
|
The following root certificates have been added to the cacerts truststore for the SSL Corporation:
|
|
|
|
Alias Name: sslrootrsaca
|
|
Distinguished Name: CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston, ST=Texas, C=US
|
|
|
|
Alias Name: sslrootevrsaca
|
|
Distinguished Name: CN=SSL.com EV Root Certification Authority RSA R2, O=SSL Corporation, L=Houston, ST=Texas, C=US
|
|
|
|
Alias Name: sslrooteccca
|
|
Distinguished Name: CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US
|
|
|
|
security-libs/javax.crypto:pkcs11:
|
|
|
|
JDK-8221441: SunPKCS11 Provider Upgraded with Support for PKCS#11 v2.40
|
|
=======================================================================
|
|
The SunPKCS11 provider has been updated with support for PKCS#11
|
|
v2.40. This version adds support for more algorithms such as the
|
|
AES/GCM/NoPadding cipher, DSA signatures using SHA-2 family of message
|
|
digests, and RSASSA-PSS signatures when the corresponding PKCS11
|
|
mechanisms are supported by the underlying PKCS11 library.
|
|
|
|
security-libs/javax.security:
|
|
|
|
JDK-8242059: Support for canonicalize in krb5.conf
|
|
==================================================
|
|
The 'canonicalize' flag in the [krb5.conf file][0] is now supported by
|
|
the JDK Kerberos implementation. When set to *true*, RFC 6806 [1] name
|
|
canonicalization is requested by clients in TGT requests to KDC
|
|
services (AS protocol). Otherwise, and by default, it is not
|
|
requested.
|
|
|
|
The new default behavior is different from previous releases where
|
|
name canonicalization was always requested by clients in TGT requests
|
|
to KDC services (provided that support for RFC 6806[1] was not
|
|
explicitly disabled with the *sun.security.krb5.disableReferrals*
|
|
system or security properties).
|
|
|
|
[0]: https://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/krb5_conf.html
|
|
[1]: https://tools.ietf.org/html/rfc6806
|
|
|
|
security-libs/javax.xml.crypto:
|
|
|
|
JDK-8202891: Updated xmldsig Implementation to Apache Santuario 2.1.1
|
|
=====================================================================
|
|
The XMLDSig provider implementation in the `java.xml.crypto` module has been updated to version 2.1.1 of Apache Santuario.
|
|
|
|
New features include:
|
|
|
|
1. Support for the SHA-224 and SHA-3 DigestMethod algorithms specified
|
|
in RFC 6931.
|
|
2. Support for the HMAC-SHA224, RSA-SHA224, ECDSA-SHA224, and
|
|
RSASSA-PSS family of SignatureMethod algorithms specified in RFC 6931.
|
|
|
|
JDK-8238185: New OpenJDK-specific JDK 8 Updates System Property to fallback to legacy Base64 Encoding format
|
|
============================================================================================================
|
|
The upgrade to the Apache Santuario libraries (see above) introduced
|
|
an issue where XML signature using Base64 encoding resulted in
|
|
appending `
` or `
` to the encoded output. This behavioural
|
|
change was made in the Apache Santuario codebase to comply with RFC
|
|
2045. The Santuario team has adopted a position of keeping their
|
|
libraries compliant with RFC 2045.
|
|
|
|
Earlier versions of OpenJDK 8 using the legacy encoder returns encoded
|
|
data in a format without `
` or `
`.
|
|
|
|
Therefore a new system property, specific to the 8 update stream,
|
|
`com.sun.org.apache.xml.internal.security.lineFeedOnly` is made
|
|
available to fall back to the legacy Base64 encoded format.
|
|
|
|
Users can set this flag in one of two ways:
|
|
|
|
1. -Dcom.sun.org.apache.xml.internal.security.lineFeedOnly=true
|
|
|
|
2. System.setProperty("com.sun.org.apache.xml.internal.security.lineFeedOnly", "true")
|
|
|
|
This new system property is disabled by default. It has no effect on
|
|
default behaviour nor when
|
|
`com.sun.org.apache.xml.internal.security.ignoreLineBreaks` property
|
|
is set.
|
|
|
|
Later JDK family versions will only support the recommended property:
|
|
|
|
`com.sun.org.apache.xml.internal.security.ignoreLineBreaks`
|
|
|
|
JDK-8254177: US/Pacific-New Zone name removed as part of tzdata2020b
|
|
====================================================================
|
|
Following JDK's update to tzdata2020b, the long-obsolete files
|
|
pacificnew and systemv have been removed. As a result, the
|
|
"US/Pacific-New" zone name declared in the pacificnew data file is no
|
|
longer available for use.
|
|
|
|
Information regarding the update can be viewed at
|
|
https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html
|
|
|
|
New in release OpenJDK 8u265 (2020-07-27):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/openjdk8u265
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u265.txt
|
|
|
|
* Bug fixes
|
|
- JDK-8249677: Regression in 8u after JDK-8237117: Better ForkJoinPool behavior
|
|
- JDK-8250546: Expect changed behaviour reported in JDK-8249846
|
|
|
|
New in release OpenJDK 8u262 (2020-07-14):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/oj8u262
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u262.txt
|
|
|
|
* New features
|
|
- JDK-8223147: JFR Backport
|
|
* Security fixes
|
|
- JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)
|
|
- JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString()
|
|
- JDK-8230613: Better ASCII conversions
|
|
- JDK-8231800: Better listing of arrays
|
|
- JDK-8232014: Expand DTD support
|
|
- JDK-8233255: Better Swing Buttons
|
|
- JDK-8234032: Improve basic calendar services
|
|
- JDK-8234042: Better factory production of certificates
|
|
- JDK-8234418: Better parsing with CertificateFactory
|
|
- JDK-8234836: Improve serialization handling
|
|
- JDK-8236191: Enhance OID processing
|
|
- JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
|
|
- JDK-8237592, CVE-2020-14577: Enhance certificate verification
|
|
- JDK-8238002, CVE-2020-14581: Better matrix operations
|
|
- JDK-8238804: Enhance key handling process
|
|
- JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
|
|
- JDK-8238843: Enhanced font handing
|
|
- JDK-8238920, CVE-2020-14583: Better Buffer support
|
|
- JDK-8238925: Enhance WAV file playback
|
|
- JDK-8240119, CVE-2020-14593: Less Affine Transformations
|
|
- JDK-8240482: Improved WAV file playback
|
|
- JDK-8241379: Update JCEKS support
|
|
- JDK-8241522: Manifest improved jar headers redux
|
|
- JDK-8242136, CVE-2020-14621: Better XML namespace handling
|
|
* Other changes
|
|
- JDK-4949105: Access Bridge lacks html tags parsing
|
|
- JDK-7147060: com/sun/org/apache/xml/internal/security/transforms/ClassLoaderTest.java doesn't run in agentvm mode
|
|
- JDK-8003209: JFR events for network utilization
|
|
- JDK-8030680: 292 cleanup from default method code assessment
|
|
- JDK-8035633: TEST_BUG: java/net/NetworkInterface/Equals.java and some tests failed on windows intermittently
|
|
- JDK-8037866: Replace the Fun class in tests with lambdas
|
|
- JDK-8041626: Shutdown tracing event
|
|
- JDK-8041915: Move 8 awt tests to OpenJDK regression tests tree
|
|
- JDK-8067796: (process) Process.waitFor(timeout, unit) doesn't throw NPE if timeout is less than, or equal to zero when unit == null
|
|
- JDK-8076475: Misuses of strncpy/strncat
|
|
- JDK-8130737: AffineTransformOp can't handle child raster with non-zero x-offset
|
|
- JDK-8141056: Erroneous assignment in HeapRegionSet.cpp
|
|
- JDK-8146612: C2: Precedence edges specification violated
|
|
- JDK-8148886: SEGV in sun.java2d.marlin.Renderer._endRendering
|
|
- JDK-8149338: JVM Crash caused by Marlin renderer not handling NaN coordinates
|
|
- JDK-8150986: serviceability/sa/jmap-hprof/JMapHProfLargeHeapTest.java failing because expects HPROF JAVA PROFILE 1.0.1 file format
|
|
- JDK-8151582: (ch) test java/nio/channels/AsyncCloseAndInterrupt.java failing due to "Connection succeeded"
|
|
- JDK-8165675: Trace event for thread park has incorrect unit for timeout
|
|
- JDK-8171934: ObjectSizeCalculator.getEffectiveMemoryLayoutSpecification() does not recognize OpenJDK's HotSpot VM
|
|
- JDK-8172559: [PIT][TEST_BUG] Move @test to be 1st annotation in java/awt/image/Raster/TestChildRasterOp.java
|
|
- JDK-8176182: 4 security tests are not run
|
|
- JDK-8178374: Problematic ByteBuffer handling in CipherSpi.bufferCrypt method
|
|
- JDK-8178910: Problemlist sample tests
|
|
- JDK-8181841: A TSA server returns timestamp with precision higher than milliseconds
|
|
- JDK-8183925: Decouple crash protection from watcher thread
|
|
- JDK-8191393: Random crashes during cfree+0x1c
|
|
- JDK-8195817: JFR.stop should require name of recording
|
|
- JDK-8195818: JFR.start should increase autogenerated name by one
|
|
- JDK-8195819: Remove recording=x from jcmd JFR.check output
|
|
- JDK-8196969: JTreg Failure: serviceability/sa/ClhsdbJstack.java causes NPE
|
|
- JDK-8199712: Flight Recorder
|
|
- JDK-8202578: Revisit location for class unload events
|
|
- JDK-8202835: jfr/event/os/TestSystemProcess.java fails on missing events
|
|
- JDK-8203287: Zero fails to build after JDK-8199712 (Flight Recorder)
|
|
- JDK-8203346: JFR: Inconsistent signature of jfr_add_string_constant
|
|
- JDK-8203664: JFR start failure after AppCDS archive created with JFR StartFlightRecording
|
|
- JDK-8203921: JFR thread sampling is missing fixes from JDK-8194552
|
|
- JDK-8203929: Limit amount of data for JFR.dump
|
|
- JDK-8205516: JFR tool
|
|
- JDK-8207392: [PPC64] Implement JFR profiling
|
|
- JDK-8207829: FlightRecorderMXBeanImpl is leaking the first classloader which calls it
|
|
- JDK-8209960: -Xlog:jfr* doesn't work with the JFR
|
|
- JDK-8210024: JFR calls virtual is_Java_thread from ~Thread()
|
|
- JDK-8210776: Upgrade X Window System 6.8.2 to the latest XWD 1.0.7
|
|
- JDK-8211239: Build fails without JFR: empty JFR events signatures mismatch
|
|
- JDK-8212232: Wrong metadata for the configuration of the cutoff for old object sample events
|
|
- JDK-8213015: Inconsistent settings between JFR.configure and -XX:FlightRecorderOptions
|
|
- JDK-8213421: Line number information for execution samples always 0
|
|
- JDK-8213617: JFR should record the PID of the recorded process
|
|
- JDK-8213734: SAXParser.parse(File, ..) does not close resources when Exception occurs.
|
|
- JDK-8213914: [TESTBUG] Several JFR VM events are not covered by tests
|
|
- JDK-8213917: [TESTBUG] Shutdown JFR event is not covered by test
|
|
- JDK-8213966: The ZGC JFR events should be marked as experimental
|
|
- JDK-8214542: JFR: Old Object Sample event slow on a deep heap in debug builds
|
|
- JDK-8214750: Unnecessary <p> tags in jfr classes
|
|
- JDK-8214896: JFR Tool left files behind
|
|
- JDK-8214906: [TESTBUG] jfr/event/sampling/TestNative.java fails with UnsatisfiedLinkError
|
|
- JDK-8214925: JFR tool fails to execute
|
|
- JDK-8215175: Inconsistencies in JFR event metadata
|
|
- JDK-8215237: jdk.jfr.Recording javadoc does not compile
|
|
- JDK-8215284: Reduce noise induced by periodic task getFileSize()
|
|
- JDK-8215355: Object monitor deadlock with no threads holding the monitor (using jemalloc 5.1)
|
|
- JDK-8215362: JFR GTest JfrTestNetworkUtilization fails
|
|
- JDK-8215771: The jfr tool should pretty print reference chains
|
|
- JDK-8216064: -XX:StartFlightRecording:settings= doesn't work properly
|
|
- JDK-8216486: Possibility of integer overflow in JfrThreadSampler::run()
|
|
- JDK-8216528: test/jdk/java/rmi/transport/runtimeThreadInheritanceLeak/RuntimeThreadInheritanceLeak.java failing with Xcomp
|
|
- JDK-8216559: [JFR] Native libraries not correctly parsed from /proc/self/maps
|
|
- JDK-8216578: Remove unused/obsolete method in JFR code
|
|
- JDK-8216995: Clean up JFR command line processing
|
|
- JDK-8217744: [TESTBUG] JFR TestShutdownEvent fails on some systems due to process surviving SIGINT
|
|
- JDK-8217748: [TESTBUG] Exclude TestSig test case from JFR TestShutdownEvent
|
|
- JDK-8218935: Make jfr strncpy uses GCC 8.x friendly
|
|
- JDK-8220293: Deadlock in JFR string pool
|
|
- JDK-8223689: Add JFR Thread Sampling Support
|
|
- JDK-8223690: Add JFR BiasedLock Event Support
|
|
- JDK-8223691: Add JFR G1 Region Type Change Event Support
|
|
- JDK-8223692: Add JFR G1 Heap Summary Event Support
|
|
- JDK-8224172: assert(jfr_is_event_enabled(id)) failed: invariant
|
|
- JDK-8224475: JTextPane does not show images in HTML rendering
|
|
- JDK-8225068: Remove DocuSign root certificate that is expiring in May 2020
|
|
- JDK-8225069: Remove Comodo root certificate that is expiring in May 2020
|
|
- JDK-8226253: JAWS reports wrong number of radio buttons when buttons are hidden.
|
|
- JDK-8226779: [TESTBUG] Test JFR API from Java agent
|
|
- JDK-8226892: ActionListeners on JRadioButtons don't get notified when selection is changed with arrow keys
|
|
- JDK-8227011: Starting a JFR recording in response to JVMTI VMInit and / or Java agent premain corrupts memory
|
|
- JDK-8227269: Slow class loading when running with JDWP
|
|
- JDK-8227605: Kitchensink fails "assert((((klass)->trace_id() & (JfrTraceIdEpoch::leakp_in_use_this_epoch_bit())) != 0)) failed: invariant"
|
|
- JDK-8229366: JFR backport allows unchecked writing to memory
|
|
- JDK-8229401: Fix JFR code cache test failures
|
|
- JDK-8229708: JFR backport code does not initialize
|
|
- JDK-8229873: 8229401 broke jdk8u-jfr-incubator
|
|
- JDK-8229888: (zipfs) Updating an existing zip file does not preserve original permissions
|
|
- JDK-8229899: Make java.io.File.isInvalid() less racy
|
|
- JDK-8230448: [test] JFRSecurityTestSuite.java is failing on Windows
|
|
- JDK-8230597: Update GIFlib library to the 5.2.1
|
|
- JDK-8230707: JFR related tests are failing
|
|
- JDK-8230769: BufImg_SetupICM add ReleasePrimitiveArrayCritical call in early return
|
|
- JDK-8230782: Robot.createScreenCapture() fails if ?awt.robot.gtk? is set to false
|
|
- JDK-8230856: Java_java_net_NetworkInterface_getByName0 on unix misses ReleaseStringUTFChars in early return
|
|
- JDK-8230926: [macosx] Two apostrophes are entered instead of one with "U.S. International - PC" layout
|
|
- JDK-8230947: TestLookForUntestedEvents.java is failing after JDK-8230707
|
|
- JDK-8231995: two jtreg tests failed after 8229366 is fixed
|
|
- JDK-8233197: Invert JvmtiExport::post_vm_initialized() and Jfr:on_vm_start() start-up order for correct option parsing
|
|
- JDK-8233623: Add classpath exception to copyright in EventHandlerProxyCreator.java file
|
|
- JDK-8233880: Support compilers with multi-digit major version numbers
|
|
- JDK-8236002: CSR for JFR backport suggests not leaving out the package-info
|
|
- JDK-8236008: Some backup files were accidentally left in the hotspot tree
|
|
- JDK-8236074: Missed package-info
|
|
- JDK-8236174: Should update javadoc since tags
|
|
- JDK-8236996: Incorrect Roboto font rendering on Windows with subpixel antialiasing
|
|
- JDK-8238076: Fix OpenJDK 7 Bootstrap Broken by JFR Backport
|
|
- JDK-8238452: Keytool generates wrong expiration date if validity is set to 2050/01/01
|
|
- JDK-8238555: Allow Initialization of SunPKCS11 with NSS when there are external FIPS modules in the NSSDB
|
|
- JDK-8238589: Necessary code cleanup in JFR for JDK8u
|
|
- JDK-8238590: Enable JFR by default during compilation in 8u
|
|
- JDK-8239055: Wrong implementation of VMState.hasListener
|
|
- JDK-8239476: JDK-8238589 broke windows build by moving OrderedPair
|
|
- JDK-8239479: minimal1 and zero builds are failing
|
|
- JDK-8239852: java/util/concurrent tests fail with -XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed: verification should have failed
|
|
- JDK-8239867: correct over use of INCLUDE_JFR macro
|
|
- JDK-8240375: Disable JFR by default for July 2020 release
|
|
- JDK-8240576: JVM crashes after transformation in C2 IdealLoopTree::merge_many_backedges
|
|
- JDK-8241444: Metaspace::_class_vsm not initialized if compressed class pointers are disabled
|
|
- JDK-8241638: launcher time metrics always report 1 on Linux when _JAVA_LAUNCHER_DEBUG set
|
|
- JDK-8241750: x86_32 build failure after JDK-8227269
|
|
- JDK-8241902: AIX Build broken after integration of JDK-8223147 (JFR Backport)
|
|
- JDK-8242788: Non-PCH build is broken after JDK-8191393
|
|
- JDK-8242883: Incomplete backport of JDK-8078268: backport test part
|
|
- JDK-8243059: Build fails when --with-vendor-name contains a comma
|
|
- JDK-8243474: [TESTBUG] removed three tests of 0 bytes
|
|
- JDK-8243539: Copyright info (Year) should be updated for fix of 8241638
|
|
- JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
|
|
- JDK-8244407: JVM crashes after transformation in C2 IdealLoopTree::split_fall_in
|
|
- JDK-8244461: [JDK 8u] Build fails with glibc 2.32
|
|
- JDK-8244548: JDK 8u: sun.misc.Version.jdkUpdateVersion() returns wrong result
|
|
- JDK-8244777: ClassLoaderStats VM Op uses constant hash value
|
|
- JDK-8244843: JapanEraNameCompatTest fails
|
|
- JDK-8245167: Top package in method profiling shows null in JMC
|
|
- JDK-8246223: Windows build fails after JDK-8227269
|
|
- JDK-8246703: [TESTBUG] Add test for JDK-8233197
|
|
- JDK-8248399: Build installs jfr binary when JFR is disabled
|
|
- JDK-8248715: New JavaTimeSupplementary localisation for 'in' installed in wrong package
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
hotspot/jfr:
|
|
|
|
JDK-8240687: JDK Flight Recorder Integrated to OpenJDK 8u
|
|
=========================================================
|
|
|
|
OpenJDK 8u now contains the backport of JEP 328: Flight Recorder
|
|
(https://openjdk.java.net/jeps/328) from later versions of OpenJDK.
|
|
|
|
JFR is a low-overhead framework to collect and provide data helpful to
|
|
troubleshoot the performance of the OpenJDK runtime and of Java
|
|
applications. It consists of a new API to define custom events under
|
|
the jdk.jfr namespace and a JMX interface to interact with the
|
|
framework. The recording can also be initiated with the application
|
|
startup using the -XX:+FlightRecorder flag or via jcmd. JFR replaces
|
|
the +XX:EnableTracing feature introduced in JEP 167, providing a more
|
|
efficient way to retrieve the same information. For compatibility
|
|
reasons, +XX:EnableTracing is still accepted, however no data will be
|
|
printed.
|
|
|
|
While JFR is not built by default upstream, it is included in Red Hat
|
|
binaries for supported architectures (x86_64, AArch64 & PowerPC 64)
|
|
|
|
hotspot/runtime:
|
|
|
|
JDK-8205622: JFR Start Failure After AppCDS Archive Created with JFR StartFlightRecording
|
|
=========================================================================================
|
|
|
|
JFR will be disabled with a warning message if it is enabled during
|
|
CDS dumping. The user will see the following warning message:
|
|
|
|
OpenJDK 64-Bit Server VM warning: JFR will be disabled during CDS dumping
|
|
|
|
if JFR is enabled during CDS dumping such as in the following command
|
|
line:
|
|
|
|
$ java -Xshare:dump -XX:StartFlightRecording=dumponexit=true
|
|
|
|
security-libs/java.security:
|
|
|
|
JDK-8244167: Removal of Comodo Root CA Certificate
|
|
==================================================
|
|
|
|
The following expired Comodo root CA certificate was removed from the
|
|
`cacerts` keystore: + alias name "addtrustclass1ca [jdk]"
|
|
|
|
Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network, O=AddTrust AB, C=SE
|
|
|
|
JDK-8244166: Removal of DocuSign Root CA Certificate
|
|
====================================================
|
|
|
|
The following expired DocuSign root CA certificate was removed from
|
|
the `cacerts` keystore: + alias name "keynectisrootca [jdk]"
|
|
|
|
Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR
|
|
|
|
security-libs/javax.crypto:pkcs11:
|
|
|
|
JDK-8240191: Allow SunPKCS11 initialization with NSS when external FIPS modules are present in the Security Modules Database
|
|
============================================================================================================================
|
|
|
|
The SunPKCS11 security provider can now be initialized with NSS when
|
|
FIPS-enabled external modules are configured in the Security Modules
|
|
Database (NSSDB). Prior to this change, the SunPKCS11 provider would
|
|
throw a RuntimeException with the message: "FIPS flag set for
|
|
non-internal module" when such a library was configured for NSS in
|
|
non-FIPS mode.
|
|
|
|
This change allows the JDK to work properly with recent NSS releases
|
|
on GNU/Linux operating systems when the system-wide FIPS policy is
|
|
turned on.
|
|
|
|
Further information can be found in JDK-8238555.
|
|
|
|
New in release OpenJDK 8u252 (2020-04-14):
|
|
===========================================
|
|
Live versions of these release notes can be found at:
|
|
* https://bitly.com/oj8u252
|
|
* https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u252.txt
|
|
|
|
* Security fixes
|
|
- JDK-8223898, CVE-2020-2754: Forward references to Nashorn
|
|
- JDK-8223904, CVE-2020-2755: Improve Nashorn matching
|
|
- JDK-8224541, CVE-2020-2756: Better mapping of serial ENUMs
|
|
- JDK-8224549, CVE-2020-2757: Less Blocking Array Queues
|
|
- JDK-8225603: Enhancement for big integers
|
|
- JDK-8227542: Manifest improved jar headers
|
|
- JDK-8231415, CVE-2020-2773: Better signatures in XML
|
|
- JDK-8233250: Better X11 rendering
|
|
- JDK-8233410: Better Build Scripting
|
|
- JDK-8234027: Better JCEKS key support
|
|
- JDK-8234408, CVE-2020-2781: Improve TLS session handling
|
|
- JDK-8234825, CVE-2020-2800: Better Headings for HTTP Servers
|
|
- JDK-8234841, CVE-2020-2803: Enhance buffering of byte buffers
|
|
- JDK-8235274, CVE-2020-2805: Enhance typing of methods
|
|
- JDK-8236201, CVE-2020-2830: Better Scanner conversions
|
|
- JDK-8238960: linux-i586 builds are inconsistent as the newly build jdk is not able to reserve enough space for object heap
|
|
* Other changes
|
|
- JDK-8005819: Support cross-realm MSSFU
|
|
- JDK-8022263: use same Clang warnings on BSD as on Linux
|
|
- JDK-8038631: Create wrapper for awt.Robot with additional functionality
|
|
- JDK-8047212: runtime/ParallelClassLoading/bootstrap/random/inner-complex assert(ObjectSynchronizer::verify_objmon_isinpool(inf)) failed: monitor is invalid
|
|
- JDK-8055283: Expand ResourceHashtable with C_HEAP allocation, removal and some unit tests
|
|
- JDK-8068184: Fix for JDK-8032832 caused a deadlock
|
|
- JDK-8079693: Add support for ECDSA P-384 and P-521 curves to XML Signature
|
|
- JDK-8132130: some docs cleanup
|
|
- JDK-8135318: CMS wrong max_eden_size for check_gc_overhead_limit
|
|
- JDK-8144445: Maximum size checking in Marlin ArrayCache utility methods is not optimal
|
|
- JDK-8144446: Automate the Marlin crash test
|
|
- JDK-8144526: Remove Marlin logging use of deleted internal API
|
|
- JDK-8144630: Use PrivilegedAction to create Thread in Marlin RendererStats
|
|
- JDK-8144654: Improve Marlin logging
|
|
- JDK-8144718: Pisces / Marlin Strokers may generate invalid curves with huge coordinates and round joins
|
|
- JDK-8166976: TestCipherPBECons has wrong @run line
|
|
- JDK-8167409: Invalid value passed to critical JNI function
|
|
- JDK-8181872: C1: possible overflow when strength reducing integer multiply by constant
|
|
- JDK-8187078: -XX:+VerifyOops finds numerous problems when running JPRT
|
|
- JDK-8191227: issues with unsafe handle resolution
|
|
- JDK-8197441: Signature#initSign/initVerify for an invalid private/public key fails with ClassCastException for SunPKCS11 provider
|
|
- JDK-8204152: SignedObject throws NullPointerException for null keys with an initialized Signature object
|
|
- JDK-8215756: Memory leaks in the AWT on macOS
|
|
- JDK-8216472: (se) Stack overflow during selection operation leads to crash (win)
|
|
- JDK-8219244: NMT: Change ThreadSafepointState's allocation type from mtInternal to mtThread
|
|
- JDK-8219597: (bf) Heap buffer state changes could provoke unexpected exceptions
|
|
- JDK-8225128: Add exception for expiring DocuSign root to VerifyCACerts test
|
|
- JDK-8225130: Add exception for expiring Comodo roots to VerifyCACerts test
|
|
- JDK-8229022: BufferedReader performance can be improved by using StringBuilder
|
|
- JDK-8229345: Memory leak due to vtable stubs not being shared on SPARC
|
|
- JDK-8229872: (fs) Increase buffer size used with getmntent
|
|
- JDK-8230235: Rendering HTML with empty img attribute and documentBaseKey cause Exception
|
|
- JDK-8231430: C2: Memory stomp in max_array_length() for T_ILLEGAL type
|
|
- JDK-8235744: PIT: test/jdk/javax/swing/text/html/TestJLabelWithHTMLText.java times out in linux-x64
|
|
- JDK-8235904: Infinite loop when rendering huge lines
|
|
- JDK-8236179: C1 register allocation error with T_ADDRESS
|
|
- JDK-8237368: Problem with NullPointerException in RMI TCPEndpoint.read
|
|
- JDK-8240521: Revert backport of 8231584: Deadlock with ClassLoader.findLibrary and System.loadLibrary call
|
|
- JDK-8241296: Segfault in JNIHandleBlock::oops_do()
|
|
- JDK-8241307: Marlin renderer should not be the default in 8u252
|
|
|
|
Notes on individual issues:
|
|
===========================
|
|
|
|
hotspot/svc:
|
|
|
|
JDK-8174881: Binary format for HPROF updated
|
|
============================================
|
|
|
|
When dumping the heap in binary format, HPROF format 1.0.2 is always
|
|
used now. Previously, format 1.0.1 was used for heaps smaller than
|
|
2GB. HPROF format 1.0.2 is also used by jhsdb jmap for the
|
|
serviceability agent.
|
|
|
|
security-libs/java.security:
|
|
|
|
JDK-8229518: Added Support for PKCS#1 v2.2 Algorithms Including RSASSA-PSS Signature
|
|
====================================================================================
|
|
|
|
The SunRsaSign and SunJCE providers have been enhanced with support
|
|
for more algorithms defined in PKCS#1 v2.2, such as RSASSA-PSS
|
|
signature and OAEP using FIPS 180-4 digest algorithms. New
|
|
constructors and methods have been added to relevant JCA/JCE classes
|
|
under the `java.security.spec` and `javax.crypto.spec` packages for
|
|
supporting additional RSASSA-PSS parameters.
|
|
|
|
security-libs/javax.crypto:
|
|
|
|
JDK-8205471: RSASSA-PSS Signature Support Added to SunMSCAPI
|
|
============================================================
|
|
|
|
The RSASSA-PSS signature algorithm support has been added to the SunMSCAPI provider.
|
|
|
|
security-libs/javax.security:
|
|
|
|
JDK-8227564: Allow SASL Mechanisms to Be Restricted
|
|
===================================================
|
|
|
|
A security property named `jdk.sasl.disabledMechanisms` has been added
|
|
that can be used to disable SASL mechanisms. Any disabled mechanism
|
|
will be ignored if it is specified in the `mechanisms` argument of
|
|
`Sasl.createSaslClient` or the `mechanism` argument of
|
|
`Sasl.createSaslServer`. The default value for this security property
|
|
is empty, which means that no mechanisms are disabled out-of-the-box.
|