jdk-sandbox: comparison jdk/src/java.base/share/classes/java/lang/invoke/MethodHandles.java

equal deleted inserted replaced

-:043f1af70518
+:9d0388c6b336
 */
 package java.lang.invoke;
 import java.lang.reflect.*;
-import java.util.*;
+import java.util.ArrayList;
+import java.util.BitSet;
+import java.util.List;
+import java.util.Arrays;
+import java.util.Objects;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import sun.invoke.util.ValueConversions;
 import sun.invoke.util.VerifyAccess;
 import sun.invoke.util.Wrapper;
 import sun.reflect.CallerSensitive;
 import static java.lang.invoke.MethodHandleImpl.Intrinsic;
 import static java.lang.invoke.MethodHandleNatives.Constants.*;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
+import jdk.internal.org.objectweb.asm.ClassWriter;
+import jdk.internal.org.objectweb.asm.Opcodes;
 /**
 * This class consists exclusively of static methods that operate on or return
 * method handles. They fall into several categories:
 * <ul>
 return new Lookup(Reflection.getCallerClass());
 }
 /**
 * Returns a {@link Lookup lookup object} which is trusted minimally.
-* It can only be used to create method handles to
+* It can only be used to create method handles to public members in
-* publicly accessible fields and methods.
+* public classes in packages that are exported unconditionally.
 * <p>
-* As a matter of pure convention, the {@linkplain Lookup#lookupClass lookup class}
+* For now, the {@linkplain Lookup#lookupClass lookup class} of this lookup
-* of this lookup object will be {@link java.lang.Object}.
+* object is in an unnamed module.
 *
 * <p style="font-size:smaller;">
 * <em>Discussion:</em>
 * The lookup class can be changed to any other class {@code C} using an expression of the form
 * {@link Lookup#in publicLookup().in(C.class)}.
-* Since all classes have equal access to public names,
-* such a change would confer no new access rights.
 * A public lookup object is always subject to
 * <a href="MethodHandles.Lookup.html#secmgr">security manager checks</a>.
 * Also, it cannot access
 * <a href="MethodHandles.Lookup.html#callsens">caller sensitive methods</a>.
 * @return a lookup object which is trusted minimally
 */
 public static Lookup publicLookup() {
-return Lookup.PUBLIC_LOOKUP;
+// During VM startup then only classes in the java.base module can be
+// loaded and linked. This is because java.base exports aren't setup until
+// the module system is initialized, hence types in the unnamed module
+// (or any named module) can't link to java/lang/Object.
+if (!jdk.internal.misc.VM.isModuleSystemInited()) {
+return new Lookup(Object.class, Lookup.PUBLIC);
+} else {
+return LookupHelper.PUBLIC_LOOKUP;
+}
 }
 /**
 * Performs an unchecked "crack" of a
 * <a href="MethodHandleInfo.html#directmh">direct method handle</a>.
 * The accesses permitted to a given lookup object may be limited,
 * according to its set of {@link #lookupModes lookupModes},
 * to a subset of members normally accessible to the lookup class.
 * For example, the {@link MethodHandles#publicLookup publicLookup}
 * method produces a lookup object which is only allowed to access
-* public members in public classes.
+* public members in public classes of exported packages.
 * The caller sensitive method {@link MethodHandles#lookup lookup}
 * produces a lookup object with full capabilities relative to
 * its caller class, to emulate all supported bytecode behaviors.
 * Also, the {@link Lookup#in Lookup.in} method may produce a lookup object
 * with fewer access modes than the original lookup object.
 *  The value is {@code 0x08}, which does not correspond meaningfully to
 *  any particular {@linkplain java.lang.reflect.Modifier modifier bit}.
 */
 public static final int PACKAGE = Modifier.STATIC;
-private static final int ALL_MODES = (PUBLIC | PRIVATE | PROTECTED | PACKAGE);
+/** A single-bit mask representing {@code module} access (default access),
+*  which may contribute to the result of {@link #lookupModes lookupModes}.
+*  The value is {@code 0x10}, which does not correspond meaningfully to
+*  any particular {@linkplain java.lang.reflect.Modifier modifier bit}.
+*  In conjunction with the {@code PUBLIC} modifier bit, a {@code Lookup}
+*  with this lookup mode can access all public types in the module of the
+*  lookup class and public types in packages exported by other modules
+*  to the module of the lookup class.
+*  @since 9
+*/
+public static final int MODULE = PACKAGE << 1;
+private static final int ALL_MODES = (PUBLIC | PRIVATE | PROTECTED | PACKAGE | MODULE);
 private static final int TRUSTED   = -1;
 private static int fixmods(int mods) {
-mods &= (ALL_MODES - PACKAGE);
+mods &= (ALL_MODES - PACKAGE - MODULE);
-return (mods != 0) ? mods : PACKAGE;
+return (mods != 0) ? mods : (PACKAGE | MODULE);
 }
 /** Tells which class is performing the lookup.  It is this class against
 *  which checks are performed for visibility and access permissions.
 *  <p>
 /** Tells which access-protection classes of members this lookup object can produce.
 *  The result is a bit-mask of the bits
 *  {@linkplain #PUBLIC PUBLIC (0x01)},
 *  {@linkplain #PRIVATE PRIVATE (0x02)},
 *  {@linkplain #PROTECTED PROTECTED (0x04)},
-*  and {@linkplain #PACKAGE PACKAGE (0x08)}.
+*  {@linkplain #PACKAGE PACKAGE (0x08)},
+*  and {@linkplain #MODULE MODULE (0x10)}.
 *  <p>
 *  A freshly-created lookup object
 *  on the {@linkplain java.lang.invoke.MethodHandles#lookup() caller's class}
-*  has all possible bits set, since the caller class can access all its own members.
+*  has all possible bits set, since the caller class can access all its own members,
+*  all public types in the caller's module, and all public types in packages exported
+*  by other modules to the caller's module.
 *  A lookup object on a new lookup class
 *  {@linkplain java.lang.invoke.MethodHandles.Lookup#in created from a previous lookup object}
 *  may have some mode bits set to zero.
 *  The purpose of this is to restrict access via the new lookup object,
 *  so that it can access only names which can be reached by the original
 * class as its own {@link #lookupClass lookupClass}.
 * <p>
 * However, the resulting {@code Lookup} object is guaranteed
 * to have no more access capabilities than the original.
 * In particular, access capabilities can be lost as follows:<ul>
+* <li>If the lookup class for this {@code Lookup} is not in a named module,
+* and the new lookup class is in a named module {@code M}, then no members in
+* {@code M}'s non-exported packages will be accessible.
+* <li>If the lookup for this {@code Lookup} is in a named module, and the
+* new lookup class is in a different module {@code M}, then no members, not even
+* public members in {@code M}'s exported packages, will be accessible.
 * <li>If the new lookup class differs from the old one,
 * protected members will not be accessible by virtue of inheritance.
 * (Protected members may continue to be accessible because of package sharing.)
 * <li>If the new lookup class is in a different package
 * than the old one, protected and default (package) members will not be accessible.
 Objects.requireNonNull(requestedLookupClass);
 if (allowedModes == TRUSTED)  // IMPL_LOOKUP can make any lookup at all
 return new Lookup(requestedLookupClass, ALL_MODES);
 if (requestedLookupClass == this.lookupClass)
 return this;  // keep same capabilities
 int newModes = (allowedModes & (ALL_MODES & ~PROTECTED));
+if (!VerifyAccess.isSameModule(this.lookupClass, requestedLookupClass)) {
+// Allowed to teleport from an unnamed to a named module but resulting
+// Lookup has no access to module private members
+if (this.lookupClass.getModule().isNamed()) {
+newModes = 0;
+} else {
+newModes &= ~MODULE;
+}
+}
 if ((newModes & PACKAGE) != 0
 && !VerifyAccess.isSamePackage(this.lookupClass, requestedLookupClass)) {
 newModes &= ~(PACKAGE|PRIVATE);
 }
 // Allow nestmate lookups to be created without special privilege:
 && !VerifyAccess.isClassAccessible(requestedLookupClass, this.lookupClass, allowedModes)) {
 // The requested class it not accessible from the lookup class.
 // No permissions.
 newModes = 0;
 }
 checkUnprivilegedlookupClass(requestedLookupClass, newModes);
 return new Lookup(requestedLookupClass, newModes);
 }
 // Make sure outer class is initialized first.
 static { IMPL_NAMES.getClass(); }
-/** Version of lookup which is trusted minimally.
-*  It can only be used to create method handles to
-*  publicly accessible members.
-*/
-static final Lookup PUBLIC_LOOKUP = new Lookup(Object.class, PUBLIC);
 /** Package-private version of lookup which is trusted. */
 static final Lookup IMPL_LOOKUP = new Lookup(Object.class, TRUSTED);
 private static void checkUnprivilegedlookupClass(Class<?> lookupClass, int allowedModes) {
 * this is indicated by adding a suffix to the class name, consisting
 * of a slash and a keyword.  The keyword represents the strongest
 * allowed access, and is chosen as follows:
 * <ul>
 * <li>If no access is allowed, the suffix is "/noaccess".
-* <li>If only public access is allowed, the suffix is "/public".
+* <li>If only public access to types in exported packages is allowed, the suffix is "/public".
-* <li>If only public and package access are allowed, the suffix is "/package".
+* <li>If only public and module access are allowed, the suffix is "/module".
-* <li>If only public, package, and private access are allowed, the suffix is "/private".
+* <li>If only public, module and package access are allowed, the suffix is "/package".
+* <li>If only public, module, package, and private access are allowed, the suffix is "/private".
 * </ul>
 * If none of the above cases apply, it is the case that full
-* access (public, package, private, and protected) is allowed.
+* access (public, module, package, private, and protected) is allowed.
 * In this case, no suffix is added.
 * This is true only of an object obtained originally from
 * {@link java.lang.invoke.MethodHandles#lookup MethodHandles.lookup}.
 * Objects created by {@link java.lang.invoke.MethodHandles.Lookup#in Lookup.in}
 * always have restricted access, and will display a suffix.
 switch (allowedModes) {
 case 0:  // no privileges
 return cname + "/noaccess";
 case PUBLIC:
 return cname + "/public";
-case PUBLIC|PACKAGE:
+case PUBLIC|MODULE:
+return cname + "/module";
+case PUBLIC|MODULE|PACKAGE:
 return cname + "/package";
 case ALL_MODES & ~PROTECTED:
 return cname + "/private";
 case ALL_MODES:
 return cname;
 void checkSymbolicClass(Class<?> refc) throws IllegalAccessException {
 Objects.requireNonNull(refc);
 Class<?> caller = lookupClassOrNull();
 if (caller != null && !VerifyAccess.isClassAccessible(refc, caller, allowedModes))
-throw new MemberName(refc).makeAccessException("symbolic reference class is not public", this);
+throw new MemberName(refc).makeAccessException("symbolic reference class is not accessible", this);
 }
 /** Check name for an illegal leading "&lt;" character. */
 void checkMethodName(byte refKind, String name) throws NoSuchMethodException {
 if (name.startsWith("<") && refKind != REF_newInvokeSpecial)
 mods ^= Modifier.PROTECTED;
 }
 if (Modifier.isFinal(mods) &&
 MethodHandleNatives.refKindIsSetter(refKind))
 throw m.makeAccessException("unexpected set of a final field", this);
-if (Modifier.isPublic(mods) && Modifier.isPublic(refc.getModifiers()) && allowedModes != 0)
-return;  // common case
 int requestedModes = fixmods(mods);  // adjust 0 => PACKAGE
 if ((requestedModes & allowedModes) != 0) {
 if (VerifyAccess.isMemberAccessible(refc, m.getDeclaringClass(),
 mods, lookupClass(), allowedModes))
 return;
 VerifyAccess.isClassAccessible(refc, lookupClass(), ALL_MODES)));
 }
 if (!classOK)
 return "class is not public";
 if (Modifier.isPublic(mods))
-return "access to public member failed";  // (how?)
+return "access to public member failed";  // (how?, module not readable?)
 if (Modifier.isPrivate(mods))
 return "member is private";
 if (Modifier.isProtected(mods))
 return "member is protected";
 return "member is private to package";
 // oops
 throw newIllegalArgumentException("bad MethodHandle constant #"+member);
 }
 static ConcurrentHashMap<MemberName, DirectMethodHandle> LOOKASIDE_TABLE = new ConcurrentHashMap<>();
+}
+/**
+* Helper class used to lazily create PUBLIC_LOOKUP with a lookup class
+* in an <em>unnamed module</em>.
+*
+* @see Lookup#publicLookup
+*/
+private static class LookupHelper {
+private static final String UNNAMED = "Unnamed";
+private static final String OBJECT  = "java/lang/Object";
+private static Class<?> createClass() {
+try {
+ClassWriter cw = new ClassWriter(0);
+cw.visit(Opcodes.V1_8,
+Opcodes.ACC_FINAL + Opcodes.ACC_SUPER,
+UNNAMED,
+null,
+OBJECT,
+null);
+cw.visitSource(UNNAMED, null);
+cw.visitEnd();
+byte[] bytes = cw.toByteArray();
+ClassLoader loader = new ClassLoader(null) {
+@Override
+protected Class<?> findClass(String cn) throws ClassNotFoundException {
+if (cn.equals(UNNAMED))
+return super.defineClass(UNNAMED, bytes, 0, bytes.length);
+throw new ClassNotFoundException(cn);
+}
+};
+return loader.loadClass(UNNAMED);
+} catch (Exception e) {
+throw new InternalError(e);
+}
+}
+private static final Class<?> PUBLIC_LOOKUP_CLASS;
+static {
+PrivilegedAction<Class<?>> pa = new PrivilegedAction<Class<?>>() {
+public Class<?> run() {
+return createClass();
+}
+};
+PUBLIC_LOOKUP_CLASS = AccessController.doPrivileged(pa);
+}
+/**
+* Lookup that is trusted minimally. It can only be used to create
+* method handles to publicly accessible members in exported packages.
+*
+* @see MethodHandles#publicLookup
+*/
+static final Lookup PUBLIC_LOOKUP = new Lookup(PUBLIC_LOOKUP_CLASS, Lookup.PUBLIC);
 }
 /**
 * Produces a method handle giving read access to elements of an array.
 * The type of the method handle will have a return type of the array's

changeset 36511	9d0388c6b336
parent 36220	32754521e67e
child 36656	a8cad521af47