Merge

make/autoconf/basic.m4

@@ -86,17 +86,18 @@ AC_DEFUN_ONCE([BASIC_SETUP_PATHS],
   AC_SUBST(TOPDIR)
   AC_SUBST(CONFIGURE_START_DIR)
 
+  # We can only call UTIL_FIXUP_PATH after BASIC_CHECK_PATHS_WINDOWS.
+  UTIL_FIXUP_PATH(TOPDIR)
+  UTIL_FIXUP_PATH(CONFIGURE_START_DIR)
+
   if test "x$CUSTOM_ROOT" != x; then
+    UTIL_FIXUP_PATH(CUSTOM_ROOT)
     WORKSPACE_ROOT="${CUSTOM_ROOT}"
   else
     WORKSPACE_ROOT="${TOPDIR}"
   fi
   AC_SUBST(WORKSPACE_ROOT)
 
-  # We can only call UTIL_FIXUP_PATH after BASIC_CHECK_PATHS_WINDOWS.
-  UTIL_FIXUP_PATH(CONFIGURE_START_DIR)
-  UTIL_FIXUP_PATH(TOPDIR)
-
   # Locate the directory of this script.
   AUTOCONF_DIR=$TOPDIR/make/autoconf
 

make/modules/java.desktop/lib/Awt2dLibraries.gmk

@@ -277,6 +277,13 @@ else
   BUILD_LIBLCMS_INCLUDE_FILES :=
 endif
 
+ifeq ($(TOOLCHAIN_TYPE), clang)
+ ifeq ($(TOOLCHAIN_VERSION), 10.1)
+   # Work around an optimizer bug seen with Xcode 10.1, but fixed by 10.3
+   BUILD_LIBLCMS_cmsopt.c_CFLAGS := -O0
+ endif
+endif
+
 $(eval $(call SetupJdkLibrary, BUILD_LIBLCMS, \
     NAME := lcms, \
     INCLUDE_FILES := $(BUILD_LIBLCMS_INCLUDE_FILES), \

src/java.base/macosx/classes/apple/security/KeychainStore.java

@@ -215,6 +215,9 @@ public final class KeychainStore extends KeyStoreSpi {
 
             // Get the Algorithm ID next
             DerValue[] value = in.getSequence(2);
+            if (value.length < 1 || value.length > 2) {
+                throw new IOException("Invalid length for AlgorithmIdentifier");
+            }
             AlgorithmId algId = new AlgorithmId(value[0].getOID());
             String algName = algId.getName();
 

src/java.base/share/classes/com/sun/crypto/provider/JceKeyStore.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -939,8 +939,6 @@ public final class JceKeyStore extends KeyStoreSpi {
      */
     private static class DeserializationChecker implements ObjectInputFilter {
 
-        private static final int MAX_NESTED_DEPTH = 2;
-
         // Full length of keystore, anything inside a SecretKeyEntry should not
         // be bigger. Otherwise, must be illegal.
         private final int fullLength;
@@ -953,16 +951,29 @@ public final class JceKeyStore extends KeyStoreSpi {
         public ObjectInputFilter.Status
             checkInput(ObjectInputFilter.FilterInfo info) {
 
-            // First run a custom filter
+            if (info.arrayLength() > fullLength) {
-            long nestedDepth = info.depth();
-            if ((nestedDepth == 1 &&
-                        info.serialClass() != SealedObjectForKeyProtector.class) ||
-                    info.arrayLength() > fullLength ||
-                    (nestedDepth > MAX_NESTED_DEPTH &&
-                        info.serialClass() != null &&
-                        info.serialClass() != Object.class)) {
                 return Status.REJECTED;
             }
+            // First run a custom filter
+            Class<?> clazz = info.serialClass();
+            switch((int)info.depth()) {
+                case 1:
+                    if (clazz != SealedObjectForKeyProtector.class) {
+                        return Status.REJECTED;
+                    }
+                    break;
+                case 2:
+                    if (clazz != null && clazz != SealedObject.class
+                            && clazz != byte[].class) {
+                        return Status.REJECTED;
+                    }
+                    break;
+                default:
+                    if (clazz != null && clazz != Object.class) {
+                        return Status.REJECTED;
+                    }
+                    break;
+            }
 
             // Next run the default filter, if available
             ObjectInputFilter defaultFilter =

src/java.base/share/classes/java/io/ObjectInputStream.java

@@ -49,6 +49,7 @@ import static java.io.ObjectStreamClass.processQueue;
 import jdk.internal.access.SharedSecrets;
 import jdk.internal.misc.Unsafe;
 import sun.reflect.misc.ReflectUtil;
+import sun.security.action.GetBooleanAction;
 
 /**
  * An ObjectInputStream deserializes primitive data and objects previously
@@ -294,6 +295,14 @@ public class ObjectInputStream
         /** queue for WeakReferences to audited subclasses */
         static final ReferenceQueue<Class<?>> subclassAuditsQueue =
             new ReferenceQueue<>();
+
+        /**
+         * Property to permit setting a filter after objects
+         * have been read.
+         * See {@link #setObjectInputFilter(ObjectInputFilter)}
+         */
+        static final boolean SET_FILTER_AFTER_READ = GetBooleanAction
+                .privilegedGetProperty("jdk.serialSetFilterAfterRead");
     }
 
     /*
@@ -1260,6 +1269,8 @@ public class ObjectInputStream
      * {@link ObjectInputFilter.Config#getSerialFilter() ObjectInputFilter.Config.getSerialFilter}
      * when the {@code  ObjectInputStream} is constructed and can be set
      * to a custom filter only once.
+     * The filter must be set before reading any objects from the stream;
+     * for example, by calling {@link #readObject} or {@link #readUnshared}.
      *
      * @implSpec
      * The filter, when not {@code null}, is invoked during {@link #readObject readObject}
@@ -1302,7 +1313,8 @@ public class ObjectInputStream
      * @throws SecurityException if there is security manager and the
      *       {@code SerializablePermission("serialFilter")} is not granted
      * @throws IllegalStateException if the {@linkplain #getObjectInputFilter() current filter}
-     *       is not {@code null} and is not the system-wide filter
+     *       is not {@code null} and is not the system-wide filter, or
+     *       if an object has been read
      * @since 9
      */
     public final void setObjectInputFilter(ObjectInputFilter filter) {
@@ -1315,6 +1327,10 @@ public class ObjectInputStream
                 serialFilter != ObjectInputFilter.Config.getSerialFilter()) {
             throw new IllegalStateException("filter can not be set more than once");
         }
+        if (totalObjectRefs > 0 && !Caches.SET_FILTER_AFTER_READ) {
+            throw new IllegalStateException(
+                    "filter can not be set after an object has been read");
+        }
         this.serialFilter = filter;
     }
 

src/java.base/share/classes/java/nio/Buffer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -364,8 +364,8 @@ public abstract class Buffer {
         if (newLimit > capacity | newLimit < 0)
             throw createLimitException(newLimit);
         limit = newLimit;
-        if (position > limit) position = limit;
+        if (position > newLimit) position = newLimit;
-        if (mark > limit) mark = -1;
+        if (mark > newLimit) mark = -1;
         return this;
     }
 
@@ -689,16 +689,18 @@ public abstract class Buffer {
      * @return  The current position value, before it is incremented
      */
     final int nextGetIndex() {                          // package-private
-        if (position >= limit)
+        int p = position;
+        if (p >= limit)
             throw new BufferUnderflowException();
-        return position++;
+        position = p + 1;
+        return p;
     }
 
     final int nextGetIndex(int nb) {                    // package-private
-        if (limit - position < nb)
-            throw new BufferUnderflowException();
         int p = position;
-        position += nb;
+        if (limit - p < nb)
+            throw new BufferUnderflowException();
+        position = p + nb;
         return p;
     }
 
@@ -710,16 +712,18 @@ public abstract class Buffer {
      * @return  The current position value, before it is incremented
      */
     final int nextPutIndex() {                          // package-private
-        if (position >= limit)
+        int p = position;
+        if (p >= limit)
             throw new BufferOverflowException();
-        return position++;
+        position = p + 1;
+        return p;
     }
 
     final int nextPutIndex(int nb) {                    // package-private
-        if (limit - position < nb)
-            throw new BufferOverflowException();
         int p = position;
-        position += nb;
+        if (limit - p < nb)
+            throw new BufferOverflowException();
+        position = p + nb;
         return p;
     }
 

src/java.base/share/classes/java/nio/file/Files.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2007, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -3702,6 +3702,8 @@ public final class Files {
         Objects.requireNonNull(cs);
 
         byte[] bytes = JLA.getBytesNoRepl(String.valueOf(csq), cs);
+        if (path.getClass().getModule() != Object.class.getModule())
+            bytes = bytes.clone();
         write(path, bytes, options);
 
         return path;

src/java.base/share/classes/java/security/MessageDigest.java

@@ -465,8 +465,10 @@ public abstract class MessageDigest extends MessageDigestSpi {
      * the same length and all bytes at corresponding positions are equal.
      *
      * @implNote
-     * If the digests are the same length, all bytes are examined to
+     * All bytes in {@code digesta} are examined to determine equality.
-     * determine equality.
+     * The calculation time depends only on the length of {@code digesta}.
+     * It does not depend on the length of {@code digestb} or the contents
+     * of {@code digesta} and {@code digestb}.
      *
      * @param digesta one of the digests to compare.
      *
@@ -479,14 +481,22 @@ public abstract class MessageDigest extends MessageDigestSpi {
         if (digesta == null || digestb == null) {
             return false;
         }
-        if (digesta.length != digestb.length) {
+
-            return false;
+        int lenA = digesta.length;
+        int lenB = digestb.length;
+
+        if (lenB == 0) {
+            return lenA == 0;
         }
 
         int result = 0;
+        result |= lenA - lenB;
+
         // time-constant comparison
-        for (int i = 0; i < digesta.length; i++) {
+        for (int i = 0; i < lenA; i++) {
-            result |= digesta[i] ^ digestb[i];
+            // If i >= lenB, indexB is 0; otherwise, i.
+            int indexB = ((i - lenB) >>> 31) * i;
+            result |= digesta[i] ^ digestb[indexB];
         }
         return result == 0;
     }

src/java.base/share/classes/java/security/PKCS12Attribute.java

@@ -254,6 +254,9 @@ public final class PKCS12Attribute implements KeyStore.Entry.Attribute {
     private void parse(byte[] encoded) throws IOException {
         DerInputStream attributeValue = new DerInputStream(encoded);
         DerValue[] attrSeq = attributeValue.getSequence(2);
+        if (attrSeq.length != 2) {
+            throw new IOException("Invalid length for PKCS12Attribute");
+        }
         ObjectIdentifier type = attrSeq[0].getOID();
         DerInputStream attrContent =
             new DerInputStream(attrSeq[1].toByteArray());

src/java.base/share/classes/java/util/ArrayList.java

@@ -178,15 +178,16 @@ public class ArrayList<E> extends AbstractList<E>
      * @throws NullPointerException if the specified collection is null
      */
     public ArrayList(Collection<? extends E> c) {
-        elementData = c.toArray();
+        Object[] a = c.toArray();
-        if ((size = elementData.length) != 0) {
+        if ((size = a.length) != 0) {
-            // defend against c.toArray (incorrectly) not returning Object[]
+            if (c.getClass() == ArrayList.class) {
-            // (see e.g. https://bugs.openjdk.java.net/browse/JDK-6260652)
+                elementData = a;
-            if (elementData.getClass() != Object[].class)
+            } else {
-                elementData = Arrays.copyOf(elementData, size, Object[].class);
+                elementData = Arrays.copyOf(a, size, Object[].class);
+            }
         } else {
             // replace with empty array.
-            this.elementData = EMPTY_ELEMENTDATA;
+            elementData = EMPTY_ELEMENTDATA;
         }
     }
 

src/java.base/share/classes/java/util/PriorityQueue.java

@@ -263,8 +263,7 @@ public class PriorityQueue<E> extends AbstractQueue<E>
     private void initElementsFromCollection(Collection<? extends E> c) {
         Object[] es = c.toArray();
         int len = es.length;
-        // If c.toArray incorrectly doesn't return Object[], copy it.
+        if (c.getClass() != ArrayList.class)
-        if (es.getClass() != Object[].class)
             es = Arrays.copyOf(es, len, Object[].class);
         if (len == 1 || this.comparator != null)
             for (Object e : es)

src/java.base/share/classes/java/util/Vector.java

@@ -179,12 +179,13 @@ public class Vector<E>
      * @since   1.2
      */
     public Vector(Collection<? extends E> c) {
-        elementData = c.toArray();
+        Object[] a = c.toArray();
-        elementCount = elementData.length;
+        elementCount = a.length;
-        // defend against c.toArray (incorrectly) not returning Object[]
+        if (c.getClass() == ArrayList.class) {
-        // (see e.g. https://bugs.openjdk.java.net/browse/JDK-6260652)
+            elementData = a;
-        if (elementData.getClass() != Object[].class)
+        } else {
-            elementData = Arrays.copyOf(elementData, elementCount, Object[].class);
+            elementData = Arrays.copyOf(a, elementCount, Object[].class);
+        }
     }
 
     /**

src/java.base/share/classes/java/util/concurrent/CopyOnWriteArrayList.java

@@ -36,6 +36,7 @@ package java.util.concurrent;
 
 import java.lang.invoke.VarHandle;
 import java.lang.reflect.Field;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
 import java.util.Comparator;
@@ -139,9 +140,7 @@ public class CopyOnWriteArrayList<E>
             es = ((CopyOnWriteArrayList<?>)c).getArray();
         else {
             es = c.toArray();
-            // defend against c.toArray (incorrectly) not returning Object[]
+            if (c.getClass() != java.util.ArrayList.class)
-            // (see e.g. https://bugs.openjdk.java.net/browse/JDK-6260652)
-            if (es.getClass() != Object[].class)
                 es = Arrays.copyOf(es, es.length, Object[].class);
         }
         setArray(es);
@@ -690,6 +689,9 @@ public class CopyOnWriteArrayList<E>
      */
     public int addAllAbsent(Collection<? extends E> c) {
         Object[] cs = c.toArray();
+        if (c.getClass() != ArrayList.class) {
+            cs = cs.clone();
+        }
         if (cs.length == 0)
             return 0;
         synchronized (lock) {
@@ -741,9 +743,10 @@ public class CopyOnWriteArrayList<E>
             Object[] es = getArray();
             int len = es.length;
             Object[] newElements;
-            if (len == 0 && cs.getClass() == Object[].class)
+            if (len == 0 && (c.getClass() == CopyOnWriteArrayList.class ||
+                             c.getClass() == ArrayList.class)) {
                 newElements = cs;
-            else {
+            } else {
                 newElements = Arrays.copyOf(es, len + cs.length);
                 System.arraycopy(cs, 0, newElements, len, cs.length);
             }

src/java.base/share/classes/java/util/concurrent/ForkJoinWorkerThread.java

@@ -78,6 +78,11 @@ public class ForkJoinWorkerThread extends Thread {
     final ForkJoinPool pool;                // the pool this thread works in
     final ForkJoinPool.WorkQueue workQueue; // work-stealing mechanics
 
+    /** An AccessControlContext supporting no privileges */
+    private static final AccessControlContext INNOCUOUS_ACC =
+        new AccessControlContext(
+            new ProtectionDomain[] { new ProtectionDomain(null, null) });
+
     /**
      * Creates a ForkJoinWorkerThread operating in the given pool.
      *
@@ -99,6 +104,7 @@ public class ForkJoinWorkerThread extends Thread {
     ForkJoinWorkerThread(ForkJoinPool pool, ClassLoader ccl) {
         super("aForkJoinWorkerThread");
         super.setContextClassLoader(ccl);
+        ThreadLocalRandom.setInheritedAccessControlContext(this, INNOCUOUS_ACC);
         this.pool = pool;
         this.workQueue = pool.registerWorker(this);
     }
@@ -214,11 +220,6 @@ public class ForkJoinWorkerThread extends Thread {
                         group, "InnocuousForkJoinWorkerThreadGroup");
                 }});
 
-        /** An AccessControlContext supporting no privileges */
-        private static final AccessControlContext INNOCUOUS_ACC =
-            new AccessControlContext(
-                new ProtectionDomain[] { new ProtectionDomain(null, null) });
-
         InnocuousForkJoinWorkerThread(ForkJoinPool pool) {
             super(pool,
                   ClassLoader.getSystemClassLoader(),

src/java.base/share/classes/java/util/concurrent/PriorityBlockingQueue.java

@@ -257,8 +257,7 @@ public class PriorityBlockingQueue<E> extends AbstractQueue<E>
         }
         Object[] es = c.toArray();
         int n = es.length;
-        // If c.toArray incorrectly doesn't return Object[], copy it.
+        if (c.getClass() != java.util.ArrayList.class)
-        if (es.getClass() != Object[].class)
             es = Arrays.copyOf(es, n, Object[].class);
         if (screen && (n == 1 || this.comparator != null)) {
             for (Object e : es)

src/java.base/share/classes/java/util/zip/ZipCoder.java

@@ -86,10 +86,14 @@ class ZipCoder {
         }
     }
 
-    String toStringUTF8(byte[] ba, int len) {
+    static String toStringUTF8(byte[] ba, int len) {
         return UTF8.toString(ba, 0, len);
     }
 
+    static String toStringUTF8(byte[] ba, int off, int len) {
+        return UTF8.toString(ba, off, len);
+    }
+
     boolean isUTF8() {
         return false;
     }

src/java.base/share/classes/java/util/zip/ZipFile.java

@@ -795,7 +795,6 @@ public class ZipFile implements ZipConstants, Closeable {
                 throw new UncheckedIOException(ioe);
             }
         }
-
     }
 
     /**
@@ -1311,6 +1310,44 @@ public class ZipFile implements ZipConstants, Closeable {
             }
         }
 
+        private static final void checkUTF8(byte[] a, int pos, int len) throws ZipException {
+            try {
+                int end = pos + len;
+                while (pos < end) {
+                    // ASCII fast-path: When checking that a range of bytes is
+                    // valid UTF-8, we can avoid some allocation by skipping
+                    // past bytes in the 0-127 range
+                    if (a[pos] < 0) {
+                        ZipCoder.toStringUTF8(a, pos, end - pos);
+                        break;
+                    }
+                    pos++;
+                }
+            } catch(Exception e) {
+                zerror("invalid CEN header (bad entry name)");
+            }
+        }
+
+        private final void checkEncoding(ZipCoder zc, byte[] a, int pos, int nlen) throws ZipException {
+            try {
+                zc.toString(a, pos, nlen);
+            } catch(Exception e) {
+                zerror("invalid CEN header (bad entry name)");
+            }
+        }
+
+        private static final int hashN(byte[] a, int off, int len) {
+            int h = 1;
+            while (len-- > 0) {
+                h = 31 * h + a[off++];
+            }
+            return h;
+        }
+
+        private static final int hash_append(int hash, byte b) {
+            return hash * 31 + b;
+        }
+
         private static class End {
             int  centot;     // 4 bytes
             long cenlen;     // 4 bytes
@@ -1489,12 +1526,18 @@ public class ZipFile implements ZipConstants, Closeable {
                 int nlen   = CENNAM(cen, pos);
                 int elen   = CENEXT(cen, pos);
                 int clen   = CENCOM(cen, pos);
-                if ((CENFLG(cen, pos) & 1) != 0)
+                int flag   = CENFLG(cen, pos);
+                if ((flag & 1) != 0)
                     zerror("invalid CEN header (encrypted entry)");
                 if (method != STORED && method != DEFLATED)
                     zerror("invalid CEN header (bad compression method: " + method + ")");
                 if (entryPos + nlen > limit)
                     zerror("invalid CEN header (bad header size)");
+                if (zc.isUTF8() || (flag & USE_UTF8) != 0) {
+                    checkUTF8(cen, pos + CENHDR, nlen);
+                } else {
+                    checkEncoding(zc, cen, pos + CENHDR, nlen);
+                }
                 // Record the CEN offset and the name hash in our hash cell.
                 hash = zipCoderForPos(pos).normalizedHash(cen, entryPos, nlen);
                 hsh = (hash & 0x7fffffff) % tablelen;

src/java.base/share/classes/java/util/zip/ZipInputStream.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -298,7 +298,7 @@ public class ZipInputStream extends InflaterInputStream implements ZipConstants
         readFully(b, 0, len);
         // Force to use UTF-8 if the USE_UTF8 bit is ON
         ZipEntry e = createZipEntry(((flag & USE_UTF8) != 0)
-                                    ? zc.toStringUTF8(b, len)
+                                    ? ZipCoder.toStringUTF8(b, len)
                                     : zc.toString(b, len));
         // now get the remaining fields for the entry
         if ((flag & 1) == 1) {

src/java.base/share/classes/jdk/internal/icu/impl/Punycode.java

@@ -186,7 +186,7 @@ public final class Punycode {
         for(j=0; j<srcLength; ++j) {
             if(srcCPCount==MAX_CP_COUNT) {
                 /* too many input code points */
-                throw new IndexOutOfBoundsException();
+                throw new ParseException("Too many input code points", -1);
             }
             c=src.charAt(j);
             if(isBasic(c)) {

src/java.base/share/classes/sun/security/pkcs/ContentInfo.java

@@ -116,6 +116,9 @@ public class ContentInfo {
         DerValue[] contents;
 
         typeAndContent = derin.getSequence(2);
+        if (typeAndContent.length < 1 || typeAndContent.length > 2) {
+            throw new ParsingException("Invalid length for ContentInfo");
+        }
 
         // Parse the content type
         type = typeAndContent[0];
@@ -135,6 +138,9 @@ public class ContentInfo {
                 disTaggedContent
                     = new DerInputStream(taggedContent.toByteArray());
                 contents = disTaggedContent.getSet(1, true);
+                if (contents.length != 1) {
+                    throw new ParsingException("ContentInfo encoding error");
+                }
                 content = contents[0];
             }
         }

src/java.base/share/classes/sun/security/pkcs/SignerInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -144,6 +144,9 @@ public class SignerInfo implements DerEncoder {
 
         // issuerAndSerialNumber
         DerValue[] issuerAndSerialNumber = derin.getSequence(2);
+        if (issuerAndSerialNumber.length != 2) {
+            throw new ParsingException("Invalid length for IssuerAndSerialNumber");
+        }
         byte[] issuerBytes = issuerAndSerialNumber[0].toByteArray();
         issuerName = new X500Name(new DerValue(DerValue.tag_Sequence,
                                                issuerBytes));

src/java.base/share/classes/sun/security/pkcs12/MacData.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999, 2007, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,10 +59,16 @@ class MacData {
         throws IOException, ParsingException
     {
         DerValue[] macData = derin.getSequence(2);
+        if (macData.length < 2 || macData.length > 3) {
+            throw new ParsingException("Invalid length for MacData");
+        }
 
         // Parse the digest info
         DerInputStream digestIn = new DerInputStream(macData[0].toByteArray());
         DerValue[] digestInfo = digestIn.getSequence(2);
+        if (digestInfo.length != 2) {
+            throw new ParsingException("Invalid length for DigestInfo");
+        }
 
         // Parse the DigestAlgorithmIdentifier.
         AlgorithmId digestAlgorithmId = AlgorithmId.parse(digestInfo[0]);

src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java

@@ -383,6 +383,9 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
                 DerInputStream in = val.toDerInputStream();
                 int i = in.getInteger();
                 DerValue[] value = in.getSequence(2);
+                if (value.length < 1 || value.length > 2) {
+                    throw new IOException("Invalid length for AlgorithmIdentifier");
+                }
                 AlgorithmId algId = new AlgorithmId(value[0].getOID());
                 String keyAlgo = algId.getName();
 
@@ -2034,11 +2037,17 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
                 DerInputStream edi =
                                 safeContents.getContent().toDerInputStream();
                 int edVersion = edi.getInteger();
-                DerValue[] seq = edi.getSequence(2);
+                DerValue[] seq = edi.getSequence(3);
+                if (seq.length != 3) {
+                    // We require the encryptedContent field, even though
+                    // it is optional
+                    throw new IOException("Invalid length for EncryptedContentInfo");
+                }
                 ObjectIdentifier edContentType = seq[0].getOID();
                 eAlgId = seq[1].toByteArray();
                 if (!seq[2].isContextSpecific((byte)0)) {
-                   throw new IOException("encrypted content not present!");
+                    throw new IOException("unsupported encrypted content type "
+                                          + seq[2].tag);
                 }
                 byte newTag = DerValue.tag_OctetString;
                 if (seq[2].isConstructed())
@@ -2379,6 +2388,9 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
             } else if (bagId.equals(CertBag_OID)) {
                 DerInputStream cs = new DerInputStream(bagValue.toByteArray());
                 DerValue[] certValues = cs.getSequence(2);
+                if (certValues.length != 2) {
+                    throw new IOException("Invalid length for CertBag");
+                }
                 ObjectIdentifier certId = certValues[0].getOID();
                 if (!certValues[1].isContextSpecific((byte)0)) {
                     throw new IOException("unsupported PKCS12 cert value type "
@@ -2394,6 +2406,9 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
             } else if (bagId.equals(SecretBag_OID)) {
                 DerInputStream ss = new DerInputStream(bagValue.toByteArray());
                 DerValue[] secretValues = ss.getSequence(2);
+                if (secretValues.length != 2) {
+                    throw new IOException("Invalid length for SecretBag");
+                }
                 ObjectIdentifier secretId = secretValues[0].getOID();
                 if (!secretValues[1].isContextSpecific((byte)0)) {
                     throw new IOException(
@@ -2432,6 +2447,9 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
                     byte[] encoded = attrSet[j].toByteArray();
                     DerInputStream as = new DerInputStream(encoded);
                     DerValue[] attrSeq = as.getSequence(2);
+                    if (attrSeq.length != 2) {
+                        throw new IOException("Invalid length for Attribute");
+                    }
                     ObjectIdentifier attrId = attrSeq[0].getOID();
                     DerInputStream vs =
                         new DerInputStream(attrSeq[1].toByteArray());

src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java

@@ -258,7 +258,7 @@ public final class OCSPResponse {
         DerInputStream basicOCSPResponse =
             new DerInputStream(derIn.getOctetString());
 
-        DerValue[] seqTmp = basicOCSPResponse.getSequence(2);
+        DerValue[] seqTmp = basicOCSPResponse.getSequence(3);
         if (seqTmp.length < 3) {
             throw new IOException("Unexpected BasicOCSPResponse value");
         }

src/java.base/share/classes/sun/security/util/DerInputBuffer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -312,15 +312,15 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
 
         if (generalized) {
             type = "Generalized";
-            year = 1000 * Character.digit((char)buf[pos++], 10);
+            year = 1000 * toDigit(buf[pos++], type);
-            year += 100 * Character.digit((char)buf[pos++], 10);
+            year += 100 * toDigit(buf[pos++], type);
-            year += 10 * Character.digit((char)buf[pos++], 10);
+            year += 10 * toDigit(buf[pos++], type);
-            year += Character.digit((char)buf[pos++], 10);
+            year += toDigit(buf[pos++], type);
             len -= 2; // For the two extra YY
         } else {
             type = "UTC";
-            year = 10 * Character.digit((char)buf[pos++], 10);
+            year = 10 * toDigit(buf[pos++], type);
-            year += Character.digit((char)buf[pos++], 10);
+            year += toDigit(buf[pos++], type);
 
             if (year < 50)              // origin 2000
                 year += 2000;
@@ -328,17 +328,17 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
                 year += 1900;   // origin 1900
         }
 
-        month = 10 * Character.digit((char)buf[pos++], 10);
+        month = 10 * toDigit(buf[pos++], type);
-        month += Character.digit((char)buf[pos++], 10);
+        month += toDigit(buf[pos++], type);
 
-        day = 10 * Character.digit((char)buf[pos++], 10);
+        day = 10 * toDigit(buf[pos++], type);
-        day += Character.digit((char)buf[pos++], 10);
+        day += toDigit(buf[pos++], type);
 
-        hour = 10 * Character.digit((char)buf[pos++], 10);
+        hour = 10 * toDigit(buf[pos++], type);
-        hour += Character.digit((char)buf[pos++], 10);
+        hour += toDigit(buf[pos++], type);
 
-        minute = 10 * Character.digit((char)buf[pos++], 10);
+        minute = 10 * toDigit(buf[pos++], type);
-        minute += Character.digit((char)buf[pos++], 10);
+        minute += toDigit(buf[pos++], type);
 
         len -= 10; // YYMMDDhhmm
 
@@ -350,12 +350,16 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
 
         millis = 0;
         if (len > 2) {
-            second = 10 * Character.digit((char)buf[pos++], 10);
+            second = 10 * toDigit(buf[pos++], type);
-            second += Character.digit((char)buf[pos++], 10);
+            second += toDigit(buf[pos++], type);
             len -= 2;
             // handle fractional seconds (if present)
-            if (buf[pos] == '.' || buf[pos] == ',') {
+            if (generalized && (buf[pos] == '.' || buf[pos] == ',')) {
                 len --;
+                if (len == 0) {
+                    throw new IOException("Parse " + type +
+                            " time, empty fractional part");
+                }
                 pos++;
                 int precision = 0;
                 while (buf[pos] != 'Z' &&
@@ -363,8 +367,13 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
                        buf[pos] != '-') {
                     // Validate all digits in the fractional part but
                     // store millisecond precision only
-                    int thisDigit = Character.digit((char)buf[pos], 10);
+                    int thisDigit = toDigit(buf[pos], type);
                     precision++;
+                    len--;
+                    if (len == 0) {
+                        throw new IOException("Parse " + type +
+                                " time, invalid fractional part");
+                    }
                     pos++;
                     switch (precision) {
                         case 1:
@@ -382,7 +391,6 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
                     throw new IOException("Parse " + type +
                             " time, empty fractional part");
                 }
-                len -= precision;
             }
         } else
             second = 0;
@@ -412,10 +420,13 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
 
         switch (buf[pos++]) {
         case '+':
-            hr = 10 * Character.digit((char)buf[pos++], 10);
+            if (len != 5) {
-            hr += Character.digit((char)buf[pos++], 10);
+                throw new IOException("Parse " + type + " time, invalid offset");
-            min = 10 * Character.digit((char)buf[pos++], 10);
+            }
-            min += Character.digit((char)buf[pos++], 10);
+            hr = 10 * toDigit(buf[pos++], type);
+            hr += toDigit(buf[pos++], type);
+            min = 10 * toDigit(buf[pos++], type);
+            min += toDigit(buf[pos++], type);
 
             if (hr >= 24 || min >= 60)
                 throw new IOException("Parse " + type + " time, +hhmm");
@@ -424,10 +435,13 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
             break;
 
         case '-':
-            hr = 10 * Character.digit((char)buf[pos++], 10);
+            if (len != 5) {
-            hr += Character.digit((char)buf[pos++], 10);
+                throw new IOException("Parse " + type + " time, invalid offset");
-            min = 10 * Character.digit((char)buf[pos++], 10);
+            }
-            min += Character.digit((char)buf[pos++], 10);
+            hr = 10 * toDigit(buf[pos++], type);
+            hr += toDigit(buf[pos++], type);
+            min = 10 * toDigit(buf[pos++], type);
+            min += toDigit(buf[pos++], type);
 
             if (hr >= 24 || min >= 60)
                 throw new IOException("Parse " + type + " time, -hhmm");
@@ -436,6 +450,9 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
             break;
 
         case 'Z':
+            if (len != 1) {
+                throw new IOException("Parse " + type + " time, invalid format");
+            }
             break;
 
         default:
@@ -443,4 +460,16 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
         }
         return new Date(time);
     }
+
+    /**
+     * Converts byte (represented as a char) to int.
+     * @throws IOException if integer is not a valid digit in the specified
+     *    radix (10)
+     */
+    private static int toDigit(byte b, String type) throws IOException {
+        if (b < '0' || b > '9') {
+            throw new IOException("Parse " + type + " time, invalid format");
+        }
+        return b - '0';
+    }
 }

src/java.base/share/classes/sun/security/util/HostnameChecker.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,6 +31,7 @@ import java.net.InetAddress;
 import java.net.UnknownHostException;
 import java.security.Principal;
 import java.security.cert.*;
+import java.text.Normalizer;
 import java.util.*;
 import javax.security.auth.x500.X500Principal;
 import javax.net.ssl.SNIHostName;
@@ -217,8 +218,12 @@ public class HostnameChecker {
                                                     (X500Name.commonName_oid);
         if (derValue != null) {
             try {
-                if (isMatched(expectedName, derValue.getAsString(),
+                String cname = derValue.getAsString();
-                              chainsToPublicCA)) {
+                if (!Normalizer.isNormalized(cname, Normalizer.Form.NFKC)) {
+                    throw new CertificateException("Not a formal name "
+                            + cname);
+                }
+                if (isMatched(expectedName, cname, chainsToPublicCA)) {
                     return;
                 }
             } catch (IOException e) {

src/java.base/share/classes/sun/security/util/ObjectIdentifier.java

@@ -52,6 +52,25 @@ import java.util.concurrent.ConcurrentHashMap;
  */
 
 public final class ObjectIdentifier implements Serializable {
+    /*
+     * The maximum encoded OID length, excluding the ASN.1 encoding tag and
+     * length.
+     *
+     * In theory, there is no maximum size for OIDs.  However, there are some
+     * limitation in practice.
+     *
+     * RFC 5280 mandates support for OIDs that have arc elements with values
+     * that are less than 2^28 (that is, they MUST be between 0 and
+     * 268,435,455, inclusive), and implementations MUST be able to handle
+     * OIDs with up to 20 elements (inclusive).  Per RFC 5280, an encoded
+     * OID should be less than 80 bytes for safe interoperability.
+     *
+     * This class could be used for protocols other than X.509 certificates.
+     * To be safe, a relatively large but still reasonable value is chosen
+     * as the restriction in JDK.
+     */
+    private static final int MAXIMUM_OID_SIZE = 4096;    // 2^12
+
     /**
      * We use the DER value (no tag, no length) as the internal format
      * @serial
@@ -118,7 +137,13 @@ public final class ObjectIdentifier implements Serializable {
             if (componentLen > comp.length) {
                 componentLen = comp.length;
             }
+
+            // Check the estimated size before it is too later.
+            checkOidSize(componentLen);
+
             init(comp, componentLen);
+        } else {
+            checkOidSize(encoding.length);
         }
     }
 
@@ -203,6 +228,8 @@ public final class ObjectIdentifier implements Serializable {
                 }
                 start = end + 1;
                 count++;
+
+                checkOidSize(pos);
             } while (end != -1);
 
             checkCount(count);
@@ -250,11 +277,13 @@ public final class ObjectIdentifier implements Serializable {
                 );
 
         int len = in.getDefiniteLength();
+        checkOidSize(len);
         if (len > in.available()) {
-            throw new IOException("ObjectIdentifier() -- length exceeds" +
+            throw new IOException("ObjectIdentifier length exceeds " +
                     "data available.  Length: " + len + ", Available: " +
                     in.available());
         }
+
         encoding = new byte[len];
         in.getBytes(encoding);
         check(encoding);
@@ -267,26 +296,32 @@ public final class ObjectIdentifier implements Serializable {
      */
     ObjectIdentifier(DerInputBuffer buf) throws IOException {
         DerInputStream in = new DerInputStream(buf);
-        encoding = new byte[in.available()];
+        int len = in.available();
+        checkOidSize(len);
+
+        encoding = new byte[len];
         in.getBytes(encoding);
         check(encoding);
     }
 
-    private void init(int[] components, int length) {
+    private void init(int[] components, int length) throws IOException {
         int pos = 0;
-        byte[] tmp = new byte[length*5+1];  // +1 for empty input
+        byte[] tmp = new byte[length * 5 + 1];  // +1 for empty input
 
-        if (components[1] < Integer.MAX_VALUE - components[0]*40)
+        if (components[1] < Integer.MAX_VALUE - components[0] * 40) {
-            pos += pack7Oid(components[0]*40+components[1], tmp, pos);
+            pos += pack7Oid(components[0] * 40 + components[1], tmp, pos);
-        else {
+        } else {
             BigInteger big = BigInteger.valueOf(components[1]);
-            big = big.add(BigInteger.valueOf(components[0]*40));
+            big = big.add(BigInteger.valueOf(components[0] * 40));
             pos += pack7Oid(big, tmp, pos);
         }
 
-        for (int i=2; i<length; i++) {
+        for (int i = 2; i < length; i++) {
             pos += pack7Oid(components[i], tmp, pos);
+
+            checkOidSize(pos);
         }
+
         encoding = new byte[pos];
         System.arraycopy(tmp, 0, encoding, 0, pos);
     }
@@ -690,4 +725,13 @@ public final class ObjectIdentifier implements Serializable {
                     "oid component #" + (i+1) + " must be non-negative ");
         }
     }
+
+    private static void checkOidSize(int oidLength) throws IOException {
+        if (oidLength > MAXIMUM_OID_SIZE) {
+            throw new IOException(
+                    "ObjectIdentifier encoded length exceeds " +
+                    "the restriction in JDK (OId length(>=): " + oidLength +
+                    ", Restriction: " + MAXIMUM_OID_SIZE + ")");
+        }
+    }
 }

src/java.desktop/macosx/native/libjsound/PLATFORM_API_MacOSX_PCM.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -202,10 +202,14 @@ public:
     // (required only if Write() can override the buffer)
     bool Allocate(int requestedBufferSize, int extraBytes) {
         int fullBufferSize = requestedBufferSize + extraBytes;
-        int powerOfTwo = 1;
+        long powerOfTwo = 1;
         while (powerOfTwo < fullBufferSize) {
             powerOfTwo <<= 1;
         }
+        if (powerOfTwo > INT_MAX || fullBufferSize < 0) {
+            ERROR0("RingBuffer::Allocate: REQUESTED MEMORY SIZE IS TOO BIG\n");
+            return false;
+        }
         pBuffer = (Byte*)malloc(powerOfTwo);
         if (pBuffer == NULL) {
             ERROR0("RingBuffer::Allocate: OUT OF MEMORY\n");

src/java.desktop/share/classes/com/sun/imageio/plugins/tiff/TIFFIFD.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -262,16 +262,16 @@ public class TIFFIFD extends TIFFDirectory {
     private static int readFieldValue(ImageInputStream stream,
         int type, int count, Object[] data) throws IOException {
         Object obj;
+        final int UNIT_SIZE = 1024000;
 
         switch (type) {
             case TIFFTag.TIFF_BYTE:
             case TIFFTag.TIFF_SBYTE:
             case TIFFTag.TIFF_UNDEFINED:
             case TIFFTag.TIFF_ASCII:
+                if (type == TIFFTag.TIFF_ASCII) {
                     byte[] bvalues = new byte[count];
                     stream.readFully(bvalues, 0, count);
-
-                if (type == TIFFTag.TIFF_ASCII) {
                     // Can be multiple strings
                     ArrayList<String> v = new ArrayList<>();
                     boolean inString = false;
@@ -312,77 +312,295 @@ public class TIFFIFD extends TIFFDirectory {
 
                     obj = strings;
                 } else {
+                    if (count < UNIT_SIZE) {
+                        byte[] bvalues = new byte[count];
+                        stream.readFully(bvalues, 0, count);
                         obj = bvalues;
+                    } else {
+                        int bytesToRead = count;
+                        int bytesRead = 0;
+                        List<byte[]> bufs = new ArrayList<>();
+                        while (bytesToRead != 0) {
+                            int sz = Math.min(bytesToRead, UNIT_SIZE);
+                            byte[] unit = new byte[sz];
+                            stream.readFully(unit, bytesRead, sz);
+                            bufs.add(unit);
+                            bytesRead += sz;
+                            bytesToRead -= sz;
+                        }
+                        byte[] tagData = new byte[bytesRead];
+                        int copiedBytes = 0;
+                        for (byte[] ba : bufs) {
+                            System.arraycopy(ba, 0, tagData, copiedBytes, ba.length);
+                            copiedBytes += ba.length;
+                        }
+                        obj = tagData;
+                    }
                 }
                 break;
 
             case TIFFTag.TIFF_SHORT:
+                final int SHORT_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_SHORT);
+                if (count < SHORT_TILE_SIZE) {
                     char[] cvalues = new char[count];
                     for (int j = 0; j < count; j++) {
                         cvalues[j] = (char) (stream.readUnsignedShort());
                     }
                     obj = cvalues;
+                } else {
+                    int charsToRead = count;
+                    int charsRead = 0;
+                    List<char[]> bufs = new ArrayList<>();
+                    while (charsToRead != 0) {
+                        int sz = Math.min(charsToRead, SHORT_TILE_SIZE);
+                        char[] unit = new char[sz];
+                        for (int i = 0; i < sz ; i++) {
+                            unit[i] = (char) (stream.readUnsignedShort());
+                        }
+                        bufs.add(unit);
+                        charsRead += sz;
+                        charsToRead -= sz;
+                    }
+                    char[] tagData = new char[charsRead];
+                    int copiedChars = 0;
+                    for (char[] ca : bufs) {
+                        System.arraycopy(ca, 0, tagData, copiedChars, ca.length);
+                        copiedChars += ca.length;
+                    }
+                    obj = tagData;
+                }
                 break;
 
             case TIFFTag.TIFF_LONG:
             case TIFFTag.TIFF_IFD_POINTER:
+                final int LONG_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_LONG);
+                if (count < LONG_TILE_SIZE) {
                     long[] lvalues = new long[count];
                     for (int j = 0; j < count; j++) {
                         lvalues[j] = stream.readUnsignedInt();
                     }
                     obj = lvalues;
+                } else {
+                    int longsToRead = count;
+                    int longsRead = 0;
+                    List<long[]> bufs = new ArrayList<>();
+                    while (longsToRead != 0) {
+                        int sz = Math.min(longsToRead, LONG_TILE_SIZE);
+                        long[] unit = new long[sz];
+                        for (int i = 0; i < sz ; i++) {
+                            unit[i] = stream.readUnsignedInt();
+                        }
+                        bufs.add(unit);
+                        longsRead += sz;
+                        longsToRead -= sz;
+                    }
+                    long[] tagData = new long[longsRead];
+                    int copiedLongs = 0;
+                    for (long[] la : bufs) {
+                        System.arraycopy(la, 0, tagData, copiedLongs, la.length);
+                        copiedLongs += la.length;
+                    }
+                    obj = tagData;
+                }
                 break;
 
             case TIFFTag.TIFF_RATIONAL:
+                final int RATIONAL_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_RATIONAL);
+                if (count < RATIONAL_TILE_SIZE) {
                     long[][] llvalues = new long[count][2];
                     for (int j = 0; j < count; j++) {
                         llvalues[j][0] = stream.readUnsignedInt();
                         llvalues[j][1] = stream.readUnsignedInt();
                     }
                     obj = llvalues;
+                } else {
+                    int rationalsToRead = count;
+                    int rationalsRead = 0;
+                    List<long[]> bufs = new ArrayList<>();
+                    while (rationalsToRead != 0) {
+                        int sz = Math.min(rationalsToRead, RATIONAL_TILE_SIZE);
+                        long[] unit = new long[sz * 2];
+                        for (int i = 0; i < (sz * 2) ; i++) {
+                            unit[i] = stream.readUnsignedInt();
+                        }
+                        bufs.add(unit);
+                        rationalsRead += sz;
+                        rationalsToRead -= sz;
+                    }
+                    long[][] tagData = new long[rationalsRead][2];
+                    int copiedRationals = 0;
+                    for (long[] la : bufs) {
+                        for (int i = 0; i < la.length; i = i + 2) {
+                            tagData[copiedRationals + i][0] = la[i];
+                            tagData[copiedRationals + i][1] = la[i + 1];
+                        }
+                        copiedRationals += (la.length / 2);
+                    }
+                    obj = tagData;
+                }
                 break;
 
             case TIFFTag.TIFF_SSHORT:
+                final int SSHORT_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_SSHORT);
+                if (count < SSHORT_TILE_SIZE) {
                     short[] svalues = new short[count];
                     for (int j = 0; j < count; j++) {
                         svalues[j] = stream.readShort();
                     }
                     obj = svalues;
+                } else {
+                    int shortsToRead = count;
+                    int shortsRead = 0;
+                    List<short[]> bufs = new ArrayList<>();
+                    while (shortsToRead != 0) {
+                        int sz = Math.min(shortsToRead, SSHORT_TILE_SIZE);
+                        short[] unit = new short[sz];
+                        stream.readFully(unit, shortsRead, sz);
+                        bufs.add(unit);
+                        shortsRead += sz;
+                        shortsToRead -= sz;
+                    }
+                    short[] tagData = new short[shortsRead];
+                    int copiedShorts = 0;
+                    for (short[] sa : bufs) {
+                        System.arraycopy(sa, 0, tagData, copiedShorts, sa.length);
+                        copiedShorts += sa.length;
+                    }
+                    obj = tagData;
+                }
                 break;
 
             case TIFFTag.TIFF_SLONG:
+                final int INT_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_SLONG);
+                if (count < INT_TILE_SIZE) {
                     int[] ivalues = new int[count];
                     for (int j = 0; j < count; j++) {
                         ivalues[j] = stream.readInt();
                     }
                     obj = ivalues;
+                } else {
+                    int intsToRead = count;
+                    int intsRead = 0;
+                    List<int[]> bufs = new ArrayList<>();
+                    while (intsToRead != 0) {
+                        int sz = Math.min(intsToRead, INT_TILE_SIZE);
+                        int[] unit = new int[sz];
+                        stream.readFully(unit, intsToRead, sz);
+                        bufs.add(unit);
+                        intsRead += sz;
+                        intsToRead -= sz;
+                    }
+                    int[] tagData = new int[intsRead];
+                    int copiedInts = 0;
+                    for (int[] ia : bufs) {
+                        System.arraycopy(ia, 0, tagData, copiedInts, ia.length);
+                        copiedInts += ia.length;
+                    }
+                    obj = tagData;
+                }
                 break;
 
             case TIFFTag.TIFF_SRATIONAL:
+                final int SRATIONAL_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_SRATIONAL);
+                if (count < SRATIONAL_TILE_SIZE) {
                     int[][] iivalues = new int[count][2];
                     for (int j = 0; j < count; j++) {
                         iivalues[j][0] = stream.readInt();
                         iivalues[j][1] = stream.readInt();
                     }
                     obj = iivalues;
+                } else {
+                    int srationalsToRead = count;
+                    int srationalsRead = 0;
+                    List<int[]> bufs = new ArrayList<>();
+                    while (srationalsToRead != 0) {
+                        int sz = Math.min(srationalsToRead, SRATIONAL_TILE_SIZE);
+                        int[] unit = new int[sz * 2];
+                        stream.readFully(unit, (srationalsToRead * 2), (sz * 2));
+                        bufs.add(unit);
+                        srationalsRead += sz;
+                        srationalsToRead -= sz;
+                    }
+                    int[][] tagData = new int[srationalsRead][2];
+                    int copiedSrationals = 0;
+                    for (int[] ia : bufs) {
+                        for (int i = 0; i < ia.length; i = i + 2) {
+                            tagData[copiedSrationals + i][0] = ia[i];
+                            tagData[copiedSrationals + i][1] = ia[i + 1];
+                        }
+                        copiedSrationals += (ia.length / 2);
+                    }
+                    obj = tagData;
+                }
                 break;
 
             case TIFFTag.TIFF_FLOAT:
+                final int FLOAT_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_FLOAT);
+                if (count < FLOAT_TILE_SIZE) {
                     float[] fvalues = new float[count];
                     for (int j = 0; j < count; j++) {
                         fvalues[j] = stream.readFloat();
                     }
                     obj = fvalues;
+                } else {
+                    int floatsToRead = count;
+                    int floatsRead = 0;
+                    List<float[]> bufs = new ArrayList<>();
+                    while (floatsToRead != 0) {
+                        int sz = Math.min(floatsToRead, FLOAT_TILE_SIZE);
+                        float[] unit = new float[sz];
+                        stream.readFully(unit, floatsToRead, sz);
+                        bufs.add(unit);
+                        floatsRead += sz;
+                        floatsToRead -= sz;
+                    }
+                    float[] tagData = new float[floatsRead];
+                    int copiedFloats = 0;
+                    for (float[] fa : bufs) {
+                        System.arraycopy(fa, 0, tagData, copiedFloats, fa.length);
+                        copiedFloats += fa.length;
+                    }
+                    obj = tagData;
+                }
                 break;
 
             case TIFFTag.TIFF_DOUBLE:
+                final int DOUBLE_TILE_SIZE =
+                    UNIT_SIZE / TIFFTag.getSizeOfType(TIFFTag.TIFF_DOUBLE);
+                if (count < DOUBLE_TILE_SIZE) {
                     double[] dvalues = new double[count];
                     for (int j = 0; j < count; j++) {
                         dvalues[j] = stream.readDouble();
                     }
                     obj = dvalues;
+                } else {
+                    int doublesToRead = count;
+                    int doublesRead = 0;
+                    List<double[]> bufs = new ArrayList<>();
+                    while (doublesToRead != 0) {
+                        int sz = Math.min(doublesToRead, DOUBLE_TILE_SIZE);
+                        double[] unit = new double[sz];
+                        stream.readFully(unit, doublesToRead, sz);
+                        bufs.add(unit);
+                        doublesRead += sz;
+                        doublesToRead -= sz;
+                    }
+                    double[] tagData = new double[doublesRead];
+                    int copiedDoubles = 0;
+                    for (double[] da : bufs) {
+                        System.arraycopy(da, 0, tagData, copiedDoubles, da.length);
+                        copiedDoubles += da.length;
+                    }
+                    obj = tagData;
+                }
                 break;
-
             default:
                 obj = null;
                 break;
@@ -875,7 +1093,7 @@ public class TIFFIFD extends TIFFDirectory {
                         // If there is an error reading a baseline tag, then re-throw
                         // the exception and fail; otherwise continue with the next
                         // field.
-                        if (BaselineTIFFTagSet.getInstance().getTag(tagNumber) == null) {
+                        if (BaselineTIFFTagSet.getInstance().getTag(tagNumber) != null) {
                             throw eofe;
                         }
                     }

src/java.desktop/share/classes/com/sun/media/sound/DirectAudioDevice.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -1067,7 +1067,7 @@ final class DirectAudioDevice extends AbstractMixer {
         public void open(AudioInputStream stream) throws LineUnavailableException, IOException {
 
             // $$fb part of fix for 4679187: Clip.open() throws unexpected Exceptions
-            Toolkit.isFullySpecifiedAudioFormat(format);
+            Toolkit.isFullySpecifiedAudioFormat(stream.getFormat());
 
             synchronized (mixer) {
                 byte[] streamData = null;
@@ -1078,11 +1078,18 @@ final class DirectAudioDevice extends AbstractMixer {
                 }
                 int lengthInFrames = (int)stream.getFrameLength();
                 int bytesRead = 0;
+                int frameSize = stream.getFormat().getFrameSize();
                 if (lengthInFrames != AudioSystem.NOT_SPECIFIED) {
                     // read the data from the stream into an array in one fell swoop.
-                    int arraysize = lengthInFrames * stream.getFormat().getFrameSize();
+                    int arraysize = lengthInFrames * frameSize;
+                    if (arraysize < 0) {
+                        throw new IllegalArgumentException("Audio data < 0");
+                    }
+                    try {
                         streamData = new byte[arraysize];
-
+                    } catch (OutOfMemoryError e) {
+                        throw new IOException("Audio data is too big");
+                    }
                     int bytesRemaining = arraysize;
                     int thisRead = 0;
                     while (bytesRemaining > 0 && thisRead >= 0) {
@@ -1100,9 +1107,14 @@ final class DirectAudioDevice extends AbstractMixer {
                     // we use a slightly modified version of ByteArrayOutputStream
                     // to get direct access to the byte array (we don't want a new array
                     // to be allocated)
-                    int MAX_READ_LIMIT = 16384;
+                    int maxReadLimit = Math.max(16384, frameSize);
                     DirectBAOS dbaos  = new DirectBAOS();
-                    byte[] tmp = new byte[MAX_READ_LIMIT];
+                    byte[] tmp;
+                    try {
+                        tmp = new byte[maxReadLimit];
+                    } catch (OutOfMemoryError e) {
+                        throw new IOException("Audio data is too big");
+                    }
                     int thisRead = 0;
                     while (thisRead >= 0) {
                         thisRead = stream.read(tmp, 0, tmp.length);
@@ -1116,7 +1128,7 @@ final class DirectAudioDevice extends AbstractMixer {
                     } // while
                     streamData = dbaos.getInternalBuffer();
                 }
-                lengthInFrames = bytesRead / stream.getFormat().getFrameSize();
+                lengthInFrames = bytesRead / frameSize;
 
                 // now try to open the device
                 open(stream.getFormat(), streamData, lengthInFrames);

src/java.desktop/share/classes/com/sun/media/sound/Toolkit.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -164,6 +164,14 @@ public final class Toolkit {
 
 
     static void isFullySpecifiedAudioFormat(AudioFormat format) {
+        // Our code requires a positive frame size, that's probably is not
+        // necessary for non-linear encodings, but for now
+        // IllegalArgumentException is better than ArithmeticException
+        if (format.getFrameSize() <= 0) {
+            throw new IllegalArgumentException("invalid frame size: "
+                                               +((format.getFrameSize() == -1) ?
+                    "NOT_SPECIFIED":String.valueOf(format.getFrameSize())));
+        }
         if (!format.getEncoding().equals(AudioFormat.Encoding.PCM_SIGNED)
             && !format.getEncoding().equals(AudioFormat.Encoding.PCM_UNSIGNED)
             && !format.getEncoding().equals(AudioFormat.Encoding.ULAW)
@@ -186,11 +194,6 @@ public final class Toolkit {
                                                +((format.getSampleSizeInBits()==-1)?
                                                  "NOT_SPECIFIED":String.valueOf(format.getSampleSizeInBits())));
         }
-        if (format.getFrameSize() <= 0) {
-            throw new IllegalArgumentException("invalid frame size: "
-                                               +((format.getFrameSize()==-1)?
-                                                 "NOT_SPECIFIED":String.valueOf(format.getFrameSize())));
-        }
         if (format.getChannels() <= 0) {
             throw new IllegalArgumentException("invalid number of channels: "
                                                +((format.getChannels()==-1)?

src/java.desktop/share/classes/sun/font/TrueTypeFont.java

@@ -503,8 +503,8 @@ public class TrueTypeFont extends FileFont {
                 tableDirectory[i] = table = new DirectoryEntry();
                 table.tag   =  ibuffer.get();
                 /* checksum */ ibuffer.get();
-                table.offset = ibuffer.get();
+                table.offset = ibuffer.get() & 0x7FFFFFFF;
-                table.length = ibuffer.get();
+                table.length = ibuffer.get() & 0x7FFFFFFF;
                 if (table.offset + table.length > fileSize) {
                     throw new FontFormatException("bad table, tag="+table.tag);
                 }

src/java.desktop/share/native/liblcms/cmsps2.c

@@ -1443,7 +1443,7 @@ int WriteNamedColorCRD(cmsIOHANDLER* m, cmsHPROFILE hNamedColor, cmsUInt32Number
     cmsUInt32Number i, nColors, nColorant;
     cmsUInt32Number OutputFormat;
     char ColorName[cmsMAX_PATH];
-    char Colorant[128];
+    char Colorant[512];
     cmsNAMEDCOLORLIST* NamedColorList;
 
 

src/java.desktop/share/native/libmlib_image/mlib_ImageScanPoly.c

@@ -415,7 +415,9 @@ mlib_status mlib_AffineEdges(mlib_affine_param *param,
         if ((dxs < dxCl) || (dxs >= dwCl) || (dys < dyCl) || (dys >= dhCl)) {
           dxs += dx;
           dys += dy;
+          if (xLeft < MLIB_S32_MAX) {
               xLeft++;
+          }
 
           if ((dxs < dxCl) || (dxs >= dwCl) || (dys < dyCl) || (dys >= dhCl))
             xRight = -1;
@@ -427,7 +429,9 @@ mlib_status mlib_AffineEdges(mlib_affine_param *param,
         if ((dxe < dxCl) || (dxe >= dwCl) || (dye < dyCl) || (dye >= dhCl)) {
           dxe -= dx;
           dye -= dy;
+          if (xRight > MLIB_S32_MIN) {
               xRight--;
+          }
 
           if ((dxe < dxCl) || (dxe >= dwCl) || (dye < dyCl) || (dye >= dhCl))
             xRight = -1;
@@ -498,7 +502,9 @@ mlib_status mlib_AffineEdges(mlib_affine_param *param,
         if ((dxs > dxCl) || (dxs <= dwCl) || (dys > dyCl) || (dys <= dhCl)) {
           dxs += dx;
           dys += dy;
+          if (xLeft < MLIB_S32_MAX) {
               xLeft++;
+          }
 
           if ((dxs > dxCl) || (dxs <= dwCl) || (dys > dyCl) || (dys <= dhCl))
             xRight = -1;
@@ -510,7 +516,9 @@ mlib_status mlib_AffineEdges(mlib_affine_param *param,
         if ((dxe > dxCl) || (dxe <= dwCl) || (dye > dyCl) || (dye <= dhCl)) {
           dxe -= dx;
           dye -= dy;
+          if (xRight > MLIB_S32_MIN) {
               xRight--;
+          }
 
           if ((dxe > dxCl) || (dxe <= dwCl) || (dye > dyCl) || (dye <= dhCl))
             xRight = -1;

src/java.desktop/unix/native/libawt_xawt/awt/gtk2_interface.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -1012,7 +1012,7 @@ static gint gtk2_copy_image(gint *dst, gint width, gint height)
     black = (*fp_gdk_pixbuf_get_pixels)(gtk2_black_pixbuf);
     stride = (*fp_gdk_pixbuf_get_rowstride)(gtk2_black_pixbuf);
     padding = stride - width * 4;
-
+    if (padding >= 0 && stride > 0) {
         for (i = 0; i < height; i++) {
             for (j = 0; j < width; j++) {
                 int r1 = *white++;
@@ -1052,6 +1052,7 @@ static gint gtk2_copy_image(gint *dst, gint width, gint height)
             white += padding;
             black += padding;
         }
+    }
     return is_opaque ? java_awt_Transparency_OPAQUE :
                        (is_bitmask ? java_awt_Transparency_BITMASK :
                                      java_awt_Transparency_TRANSLUCENT);

src/java.desktop/unix/native/libawt_xawt/awt/gtk3_interface.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -347,8 +347,10 @@ GtkApi* gtk3_load(JNIEnv *env, const char* lib_name)
 
         fp_cairo_image_surface_create = dl_symbol("cairo_image_surface_create");
         fp_cairo_surface_destroy = dl_symbol("cairo_surface_destroy");
+        fp_cairo_surface_status = dl_symbol("cairo_surface_status");
         fp_cairo_create = dl_symbol("cairo_create");
         fp_cairo_destroy = dl_symbol("cairo_destroy");
+        fp_cairo_status = dl_symbol("cairo_status");
         fp_cairo_fill = dl_symbol("cairo_fill");
         fp_cairo_rectangle = dl_symbol("cairo_rectangle");
         fp_cairo_set_source_rgb = dl_symbol("cairo_set_source_rgb");
@@ -777,6 +779,9 @@ static void gtk3_init_painting(JNIEnv *env, gint width, gint height)
     }
 
     cr = fp_cairo_create(surface);
+    if (fp_cairo_surface_status(surface) || fp_cairo_status(cr)) {
+        JNU_ThrowOutOfMemoryError(env, "The surface size is too big");
+    }
 }
 
 /*
@@ -799,7 +804,7 @@ static gint gtk3_copy_image(gint *dst, gint width, gint height)
     data = (*fp_cairo_image_surface_get_data)(surface);
     stride = (*fp_cairo_image_surface_get_stride)(surface);
     padding = stride - width * 4;
-
+    if (stride > 0 && padding >= 0) {
         for (i = 0; i < height; i++) {
             for (j = 0; j < width; j++) {
                 int r = *data++;
@@ -810,6 +815,7 @@ static gint gtk3_copy_image(gint *dst, gint width, gint height)
             }
             data += padding;
         }
+    }
     return java_awt_Transparency_TRANSLUCENT;
 }
 

src/java.desktop/unix/native/libawt_xawt/awt/gtk3_interface.h

@@ -132,6 +132,48 @@ typedef enum {
     CAIRO_FORMAT_RGB16_565 = 4
 } cairo_format_t;
 
+typedef enum _cairo_status {
+    CAIRO_STATUS_SUCCESS = 0,
+
+    CAIRO_STATUS_NO_MEMORY,
+    CAIRO_STATUS_INVALID_RESTORE,
+    CAIRO_STATUS_INVALID_POP_GROUP,
+    CAIRO_STATUS_NO_CURRENT_POINT,
+    CAIRO_STATUS_INVALID_MATRIX,
+    CAIRO_STATUS_INVALID_STATUS,
+    CAIRO_STATUS_NULL_POINTER,
+    CAIRO_STATUS_INVALID_STRING,
+    CAIRO_STATUS_INVALID_PATH_DATA,
+    CAIRO_STATUS_READ_ERROR,
+    CAIRO_STATUS_WRITE_ERROR,
+    CAIRO_STATUS_SURFACE_FINISHED,
+    CAIRO_STATUS_SURFACE_TYPE_MISMATCH,
+    CAIRO_STATUS_PATTERN_TYPE_MISMATCH,
+    CAIRO_STATUS_INVALID_CONTENT,
+    CAIRO_STATUS_INVALID_FORMAT,
+    CAIRO_STATUS_INVALID_VISUAL,
+    CAIRO_STATUS_FILE_NOT_FOUND,
+    CAIRO_STATUS_INVALID_DASH,
+    CAIRO_STATUS_INVALID_DSC_COMMENT,
+    CAIRO_STATUS_INVALID_INDEX,
+    CAIRO_STATUS_CLIP_NOT_REPRESENTABLE,
+    CAIRO_STATUS_TEMP_FILE_ERROR,
+    CAIRO_STATUS_INVALID_STRIDE,
+    CAIRO_STATUS_FONT_TYPE_MISMATCH,
+    CAIRO_STATUS_USER_FONT_IMMUTABLE,
+    CAIRO_STATUS_USER_FONT_ERROR,
+    CAIRO_STATUS_NEGATIVE_COUNT,
+    CAIRO_STATUS_INVALID_CLUSTERS,
+    CAIRO_STATUS_INVALID_SLANT,
+    CAIRO_STATUS_INVALID_WEIGHT,
+    CAIRO_STATUS_INVALID_SIZE,
+    CAIRO_STATUS_USER_FONT_NOT_IMPLEMENTED,
+    CAIRO_STATUS_DEVICE_TYPE_MISMATCH,
+    CAIRO_STATUS_DEVICE_ERROR,
+
+    CAIRO_STATUS_LAST_STATUS
+} cairo_status_t;
+
 /* We define all structure pointers to be void* */
 typedef void GdkPixbuf;
 typedef void GMainContext;
@@ -364,8 +406,10 @@ static void (*fp_g_strfreev)(gchar **str_array);
 static cairo_surface_t* (*fp_cairo_image_surface_create)(cairo_format_t format,
                                int width, int height);
 static void (*fp_cairo_surface_destroy)(cairo_surface_t *surface);
+static cairo_status_t (*fp_cairo_surface_status)(cairo_surface_t *surface);
 static cairo_t* (*fp_cairo_create)(cairo_surface_t *target);
 static void (*fp_cairo_destroy)(cairo_t *cr);
+static cairo_status_t (*fp_cairo_status)(cairo_t *cr);
 static void (*fp_cairo_fill)(cairo_t *cr);
 static void (*fp_cairo_surface_flush)(cairo_surface_t *surface);
 static void (*fp_cairo_rectangle)(cairo_t *cr, double x, double y, double width,

src/java.desktop/unix/native/libawt_xawt/awt/swing_GTKEngine.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2005, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2005, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -23,10 +23,11 @@
  * questions.
  */
 
-#include <stdlib.h>
-#include <string.h>
 #include "gtk_interface.h"
 #include "com_sun_java_swing_plaf_gtk_GTKEngine.h"
+#include <jni_util.h>
+#include <stdlib.h>
+#include <string.h>
 
 /* Static buffer for conversion from java.lang.String to UTF-8 */
 static char conversionBuffer[(CONV_BUFFER_SIZE - 1) * 3 + 1];
@@ -309,6 +310,11 @@ JNIEXPORT void JNICALL
 Java_com_sun_java_swing_plaf_gtk_GTKEngine_nativeStartPainting(
         JNIEnv *env, jobject this, jint w, jint h)
 {
+    if (w > 0x7FFF || h > 0x7FFF || (uintptr_t)4 * w * h > 0x7FFFFFFFL) {
+        // Same limitation as in X11SurfaceData.c
+        JNU_ThrowOutOfMemoryError(env, "Can't create offscreen surface");
+        return;
+    }
     gtk->gdk_threads_enter();
     gtk->init_painting(env, w, h);
     gtk->gdk_threads_leave();

src/java.instrument/share/native/libinstrument/EncodingSupport.c

@@ -38,7 +38,11 @@ modifiedUtf8LengthOfUtf8(char* string, int length) {
     int i;
 
     new_length = 0;
-    for ( i = 0 ; i < length ; i++ ) {
+    /*
+     * if length < 0 or new_length becomes < 0 => string is too big
+     * (handled as error after the cycle).
+     */
+    for ( i = 0 ; i < length && new_length >= 0 ; i++ ) {
         unsigned byte;
 
         byte = (unsigned char)string[i];

src/java.instrument/share/native/libinstrument/InvocationAdapter.c

@@ -205,8 +205,10 @@ DEF_Agent_OnLoad(JavaVM *vm, char *tail, void * reserved) {
         /*
          * According to JVMS class name is represented as CONSTANT_Utf8_info,
          * so its length is u2 (i.e. must be <= 0xFFFF).
+         * Negative oldLen or newLen means we got signed integer overflow
+         * (modifiedUtf8LengthOfUtf8 returns negative value if oldLen is negative).
          */
-        if (newLen > 0xFFFF) {
+        if (oldLen < 0 || newLen < 0 || newLen > 0xFFFF) {
             fprintf(stderr, "-javaagent: Premain-Class value is too big\n");
             free(jarfile);
             if (options != NULL) free(options);
@@ -374,8 +376,10 @@ DEF_Agent_OnAttach(JavaVM* vm, char *args, void * reserved) {
         /*
          * According to JVMS class name is represented as CONSTANT_Utf8_info,
          * so its length is u2 (i.e. must be <= 0xFFFF).
+         * Negative oldLen or newLen means we got signed integer overflow
+         * (modifiedUtf8LengthOfUtf8 returns negative value if oldLen is negative).
          */
-        if (newLen > 0xFFFF) {
+        if (oldLen < 0 || newLen < 0 || newLen > 0xFFFF) {
             fprintf(stderr, "Agent-Class value is too big\n");
             free(jarfile);
             if (options != NULL) free(options);
@@ -510,8 +514,10 @@ jint loadAgent(JNIEnv* env, jstring path) {
     /*
      * According to JVMS class name is represented as CONSTANT_Utf8_info,
      * so its length is u2 (i.e. must be <= 0xFFFF).
+     * Negative oldLen or newLen means we got signed integer overflow
+     * (modifiedUtf8LengthOfUtf8 returns negative value if oldLen is negative).
      */
-    if (newLen > 0xFFFF) {
+    if (oldLen < 0 || newLen < 0 || newLen > 0xFFFF) {
         goto releaseAndReturn;
     }
     if (newLen == oldLen) {
@@ -556,7 +562,7 @@ jint loadAgent(JNIEnv* env, jstring path) {
     // initialization complete
     result = JNI_OK;
 
-    releaseAndReturn:
+releaseAndReturn:
     if (agentClass != NULL) {
         free(agentClass);
     }

src/java.xml/share/classes/com/sun/org/apache/xerces/internal/impl/XMLDTDScannerImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -63,7 +63,7 @@ import java.io.IOException;
  * @author Glenn Marcy, IBM
  * @author Eric Ye, IBM
  *
- * @LastModified: Nov 2017
+ * @LastModified: Feb 2020
  */
 public class XMLDTDScannerImpl
 extends XMLScanner
@@ -608,6 +608,7 @@ implements XMLDTDScanner, XMLComponent, XMLEntityHandler {
         if (fScannerState == SCANNER_STATE_END_OF_INPUT)
             return;
 
+        boolean dtdEntity = name.equals("[dtd]");
         // Handle end of PE
         boolean reportEntity = fReportEntity;
         if (name.startsWith("%")) {
@@ -616,8 +617,7 @@ implements XMLDTDScanner, XMLComponent, XMLEntityHandler {
             int startMarkUpDepth = popPEStack();
             // throw fatalError if this entity was incomplete and
             // was a freestanding decl
-            if(startMarkUpDepth == 0 &&
+            if (startMarkUpDepth == 0 && startMarkUpDepth < fMarkUpDepth) {
-            startMarkUpDepth < fMarkUpDepth) {
                 fErrorReporter.reportError(XMLMessageFormatter.XML_DOMAIN,
                 "ILL_FORMED_PARAMETER_ENTITY_WHEN_USED_IN_DECL",
                 new Object[]{ fEntityManager.fCurrentEntity.name},
@@ -637,13 +637,11 @@ implements XMLDTDScanner, XMLComponent, XMLEntityHandler {
             if (fEntityScanner.isExternal()) {
                 fExtEntityDepth--;
             }
-        }
-
             // call handler
-        boolean dtdEntity = name.equals("[dtd]");
+            if (fDTDHandler != null && reportEntity) {
-        if (fDTDHandler != null && !dtdEntity && reportEntity) {
                 fDTDHandler.endParameterEntity(name, null);
             }
+        }
 
         // end DTD
         if (dtdEntity) {

src/java.xml/share/classes/com/sun/org/apache/xerces/internal/impl/XMLScanner.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2020, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -67,7 +67,7 @@ import com.sun.xml.internal.stream.Entity;
  * @author Eric Ye, IBM
  * @author K.Venugopal SUN Microsystems
  * @author Sunitha Reddy, SUN Microsystems
- * @LastModified: Nov 2017
+ * @LastModified: Feb 2020
  */
 public abstract class XMLScanner
         implements XMLComponent {
@@ -1239,10 +1239,10 @@ public abstract class XMLScanner
      * @throws XNIException Thrown by handler to signal an error.
      */
     public void endEntity(String name, Augmentations augs) throws IOException, XNIException {
-
         // keep track of the entity depth
+        if (fEntityDepth > 0) {
             fEntityDepth--;
-
+        }
     } // endEntity(String)
 
     /**

src/java.xml/share/classes/com/sun/org/apache/xerces/internal/impl/dtd/DTDGrammar.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2020, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -62,7 +62,7 @@ import java.util.Random;
  * @author Andy Clark, IBM
  * @author Neil Graham, IBM
  *
- * @LastModified: Oct 2017
+ * @LastModified: Feb 2020
  */
 public class DTDGrammar
     implements XMLDTDHandler, XMLDTDContentModelHandler, EntityState, Grammar {
@@ -447,9 +447,12 @@ public class DTDGrammar
      * @throws XNIException Thrown by handler to signal an error.
      */
     public void endParameterEntity(String name, Augmentations augs) throws XNIException {
-
+        // redundant check as this method can only be called after parsing a PE
+        // incomplete or truncated DTD get caught before reaching this method
+        if (fPEDepth > 0) {
             fPEDepth--;
             fReadingExternalDTD = fPEntityStack[fPEDepth];
+        }
 
     } // endParameterEntity(String,Augmentations)
 

src/java.xml/share/classes/com/sun/org/apache/xerces/internal/impl/xs/XMLSchemaValidator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2020, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -111,7 +111,7 @@ import jdk.xml.internal.JdkXmlUtils;
  * @author Elena Litani IBM
  * @author Andy Clark IBM
  * @author Neeraj Bajaj, Sun Microsystems, inc.
- * @LastModified: Apr 2019
+ * @LastModified: Apr 2020
  */
 public class XMLSchemaValidator
     implements XMLComponent, XMLDocumentFilter, FieldActivator, RevalidationHandler, XSElementDeclHelper {
@@ -1887,7 +1887,7 @@ public class XMLSchemaValidator
 
         // root element
         if (fElementDepth == -1 && fValidationManager.isGrammarFound()) {
-            if (fSchemaType == null) {
+            if (fSchemaType == null && !fUseGrammarPoolOnly) {
                 // schemaType is not specified
                 // if a DTD grammar is found, we do the same thing as Dynamic:
                 // if a schema grammar is found, validation is performed;

src/jdk.internal.vm.ci/share/classes/jdk.vm.ci.hotspot/src/jdk/vm/ci/hotspot/HotSpotConstantPool.java

@@ -620,6 +620,39 @@ public final class HotSpotConstantPool implements ConstantPool, MetaspaceHandleO
         }
     }
 
+    @Override
+    public JavaType lookupReferencedType(int cpi, int opcode) {
+        int index;
+        switch (opcode) {
+            case Bytecodes.CHECKCAST:
+            case Bytecodes.INSTANCEOF:
+            case Bytecodes.NEW:
+            case Bytecodes.ANEWARRAY:
+            case Bytecodes.MULTIANEWARRAY:
+            case Bytecodes.LDC:
+            case Bytecodes.LDC_W:
+            case Bytecodes.LDC2_W:
+                index = cpi;
+                break;
+            case Bytecodes.GETSTATIC:
+            case Bytecodes.PUTSTATIC:
+            case Bytecodes.GETFIELD:
+            case Bytecodes.PUTFIELD:
+            case Bytecodes.INVOKEVIRTUAL:
+            case Bytecodes.INVOKESPECIAL:
+            case Bytecodes.INVOKESTATIC:
+            case Bytecodes.INVOKEINTERFACE: {
+                index = rawIndexToConstantPoolCacheIndex(cpi, opcode);
+                index = getKlassRefIndexAt(index);
+                break;
+            }
+            default:
+                throw JVMCIError.shouldNotReachHere("Unexpected opcode " + opcode);
+        }
+        final Object type = compilerToVM().lookupKlassInPool(this, index);
+        return getJavaType(type);
+    }
+
     @Override
     public JavaField lookupField(int cpi, ResolvedJavaMethod method, int opcode) {
         final int index = rawIndexToConstantPoolCacheIndex(cpi, opcode);

src/jdk.internal.vm.ci/share/classes/jdk.vm.ci.meta/src/jdk/vm/ci/meta/ConstantPool.java

@@ -46,6 +46,16 @@ public interface ConstantPool {
      */
     void loadReferencedType(int cpi, int opcode);
 
+    /**
+     * Looks up the type referenced by the constant pool entry at {@code cpi} as referenced by the
+     * {@code opcode} bytecode instruction.
+     *
+     * @param cpi the index of a constant pool entry that references a type
+     * @param opcode the opcode of the instruction with {@code cpi} as an operand
+     * @return a reference to the compiler interface type
+     */
+    JavaType lookupReferencedType(int cpi, int opcode);
+
     /**
      * Looks up a reference to a field. If {@code opcode} is non-negative, then resolution checks
      * specific to the bytecode it denotes are performed if the field is already resolved. Checks

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.core.test/src/org/graalvm/compiler/core/test/SingleImplementorInterfaceTest.java

@@ -0,0 +1,151 @@
+/*
+ * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package org.graalvm.compiler.core.test;
+
+import jdk.vm.ci.meta.ResolvedJavaType;
+import org.graalvm.compiler.nodes.CallTargetNode;
+import org.graalvm.compiler.nodes.InvokeNode;
+import org.graalvm.compiler.nodes.StructuredGraph;
+import org.graalvm.compiler.nodes.java.InstanceOfNode;
+import org.graalvm.compiler.phases.OptimisticOptimizations;
+import org.graalvm.compiler.phases.tiers.HighTierContext;
+import org.graalvm.compiler.serviceprovider.GraalServices;
+import org.junit.Test;
+
+public class SingleImplementorInterfaceTest extends GraalCompilerTest {
+
+    public interface Interface0 {
+        void interfaceMethod();
+    }
+
+    public interface Interface1 extends Interface0 {
+
+    }
+
+    public interface Interface2 extends Interface1 {
+    }
+
+    @SuppressWarnings("all")
+    public static class SingleImplementor1 implements Interface1 {
+        public void interfaceMethod() {
+        }
+    }
+
+    // Requires that the CHA analysis starts from the referenced type. Since {@code
+    // SingleImplementor1}
+    // is not a single implementor of {@code Interface2} devirtualization shouldn't happen.
+    @SuppressWarnings("all")
+    private static void singleImplementorInterfaceSnippet1(Interface2 i) {
+        i.interfaceMethod();
+    }
+
+    // Devirtualization should happen in this case.
+    @SuppressWarnings("all")
+    private static void singleImplementorInterfaceSnippet2(Interface1 i) {
+        i.interfaceMethod();
+    }
+
+    @Test
+    public void testSingleImplementorInterfaceDevirtualization1() {
+        ResolvedJavaType singleImplementorType = getMetaAccess().lookupJavaType(SingleImplementor1.class);
+        ResolvedJavaType expectedReferencedType = getMetaAccess().lookupJavaType(Interface2.class);
+        singleImplementorType.initialize();
+        StructuredGraph graph = parseEager("singleImplementorInterfaceSnippet1", StructuredGraph.AllowAssumptions.YES);
+        createCanonicalizerPhase().apply(graph, getProviders());
+        // Devirtualization shouldn't work in this case. The invoke should remain intact.
+        InvokeNode invoke = graph.getNodes().filter(InvokeNode.class).first();
+        assertTrue(invoke != null, "Should have an invoke");
+        assertTrue(invoke.callTarget().invokeKind() == CallTargetNode.InvokeKind.Interface, "Should still be an interface call");
+        if (GraalServices.hasLookupReferencedType()) {
+            assertTrue(invoke.callTarget().referencedType() != null, "Invoke should have a reference class set");
+            assertTrue(invoke.callTarget().referencedType().equals(expectedReferencedType));
+        }
+    }
+
+    @Test
+    public void testSingleImplementorInterfaceDevirtualization2() {
+        ResolvedJavaType singleImplementorType = getMetaAccess().lookupJavaType(SingleImplementor1.class);
+        singleImplementorType.initialize();
+        StructuredGraph graph = parseEager("singleImplementorInterfaceSnippet2", StructuredGraph.AllowAssumptions.YES);
+        createCanonicalizerPhase().apply(graph, getProviders());
+        InvokeNode invoke = graph.getNodes().filter(InvokeNode.class).first();
+        assertTrue(invoke != null, "Should have an invoke");
+        if (GraalServices.hasLookupReferencedType()) {
+            assertTrue(invoke.callTarget().invokeKind() == CallTargetNode.InvokeKind.Special, "Should be devirtualized");
+            InstanceOfNode instanceOfNode = graph.getNodes().filter(InstanceOfNode.class).first();
+            assertTrue(instanceOfNode != null, "Missing the subtype check");
+            assertTrue(instanceOfNode.getCheckedStamp().type().equals(singleImplementorType), "Checking against a wrong type");
+        } else {
+            assertTrue(invoke.callTarget().invokeKind() == CallTargetNode.InvokeKind.Interface, "Should not be devirtualized");
+        }
+    }
+
+    @Test
+    public void testSingleImplementorInterfaceInlining1() {
+        ResolvedJavaType singleImplementorType = getMetaAccess().lookupJavaType(SingleImplementor1.class);
+        ResolvedJavaType expectedReferencedType = getMetaAccess().lookupJavaType(Interface2.class);
+        singleImplementorType.initialize();
+        StructuredGraph graph = parseEager("singleImplementorInterfaceSnippet1", StructuredGraph.AllowAssumptions.YES);
+        HighTierContext context = new HighTierContext(getProviders(), getDefaultGraphBuilderSuite(), OptimisticOptimizations.ALL);
+        createInliningPhase().apply(graph, context);
+        // Inlining shouldn't do anything
+        InvokeNode invoke = graph.getNodes().filter(InvokeNode.class).first();
+        assertTrue(invoke != null, "Should have an invoke");
+        if (GraalServices.hasLookupReferencedType()) {
+            assertTrue(invoke.callTarget().referencedType() != null, "Invoke should have a reference class set");
+            assertTrue(invoke.callTarget().invokeKind() == CallTargetNode.InvokeKind.Interface, "Should still be an interface call");
+            assertTrue(invoke.callTarget().referencedType().equals(expectedReferencedType));
+        } else {
+            assertTrue(invoke.callTarget().invokeKind() == CallTargetNode.InvokeKind.Interface, "Should not be devirtualized");
+        }
+    }
+
+    @Test
+    public void testSingleImplementorInterfaceInlining2() {
+        ResolvedJavaType singleImplementorType = getMetaAccess().lookupJavaType(SingleImplementor1.class);
+        ResolvedJavaType expectedReferencedType = getMetaAccess().lookupJavaType(Interface1.class);
+        singleImplementorType.initialize();
+        StructuredGraph graph = parseEager("singleImplementorInterfaceSnippet2", StructuredGraph.AllowAssumptions.YES);
+        HighTierContext context = new HighTierContext(getProviders(), getDefaultGraphBuilderSuite(), OptimisticOptimizations.ALL);
+        createInliningPhase().apply(graph, context);
+
+        // Right now inlining will not do anything, but if it starts doing devirtualization of
+        // interface calls
+        // in the future there should be a subtype check.
+        InvokeNode invoke = graph.getNodes().filter(InvokeNode.class).first();
+        if (invoke != null) {
+            assertTrue(invoke.callTarget().invokeKind() == CallTargetNode.InvokeKind.Interface, "Should still be an interface call");
+            if (GraalServices.hasLookupReferencedType()) {
+                assertTrue(invoke.callTarget().referencedType() != null, "Invoke should have a reference class set");
+                assertTrue(invoke.callTarget().referencedType().equals(expectedReferencedType));
+            }
+        } else {
+            InstanceOfNode instanceOfNode = graph.getNodes().filter(InstanceOfNode.class).first();
+            assertTrue(instanceOfNode != null, "Missing the subtype check");
+            assertTrue(instanceOfNode.getCheckedStamp().type().equals(singleImplementorType), "Checking against a wrong type");
+        }
+    }
+}

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.core.test/src/org/graalvm/compiler/core/test/inlining/InliningTest.java

@@ -43,6 +43,7 @@ import org.graalvm.compiler.phases.OptimisticOptimizations;
 import org.graalvm.compiler.phases.PhaseSuite;
 import org.graalvm.compiler.phases.common.DeadCodeEliminationPhase;
 import org.graalvm.compiler.phases.tiers.HighTierContext;
+import org.graalvm.compiler.serviceprovider.GraalServices;
 import org.junit.Assert;
 import org.junit.Ignore;
 import org.junit.Test;
@@ -182,7 +183,9 @@ public class InliningTest extends GraalCompilerTest {
     public void testClassHierarchyAnalysis() {
         assertInlined(getGraph("invokeLeafClassMethodSnippet", false));
         assertInlined(getGraph("invokeConcreteMethodSnippet", false));
+        if (GraalServices.hasLookupReferencedType()) {
             assertInlined(getGraph("invokeSingleImplementorInterfaceSnippet", false));
+        }
         // assertInlined(getGraph("invokeConcreteInterfaceMethodSnippet", false));
 
         assertNotInlined(getGraph("invokeOverriddenPublicMethodSnippet", false));
@@ -194,7 +197,9 @@ public class InliningTest extends GraalCompilerTest {
     public void testClassHierarchyAnalysisIP() {
         assertManyMethodInfopoints(assertInlined(getGraph("invokeLeafClassMethodSnippet", true)));
         assertManyMethodInfopoints(assertInlined(getGraph("invokeConcreteMethodSnippet", true)));
+        if (GraalServices.hasLookupReferencedType()) {
             assertManyMethodInfopoints(assertInlined(getGraph("invokeSingleImplementorInterfaceSnippet", true)));
+        }
         //@formatter:off
         // assertInlineInfopoints(assertInlined(getGraph("invokeConcreteInterfaceMethodSnippet", true)));
         //@formatter:on

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.java/src/org/graalvm/compiler/java/BytecodeParser.java

@@ -434,6 +434,7 @@ import org.graalvm.compiler.nodes.util.GraphUtil;
 import org.graalvm.compiler.options.OptionValues;
 import org.graalvm.compiler.phases.OptimisticOptimizations;
 import org.graalvm.compiler.phases.util.ValueMergeUtil;
+import org.graalvm.compiler.serviceprovider.GraalServices;
 import org.graalvm.compiler.serviceprovider.JavaVersionUtil;
 import jdk.internal.vm.compiler.word.LocationIdentity;
 
@@ -1687,13 +1688,17 @@ public class BytecodeParser implements GraphBuilderContext {
 
     protected void genInvokeInterface(int cpi, int opcode) {
         JavaMethod target = lookupMethod(cpi, opcode);
-        genInvokeInterface(target);
+        JavaType referencedType = lookupReferencedTypeInPool(cpi, opcode);
+        genInvokeInterface(referencedType, target);
     }
 
-    protected void genInvokeInterface(JavaMethod target) {
+    protected void genInvokeInterface(JavaType referencedType, JavaMethod target) {
-        if (callTargetIsResolved(target)) {
+        if (callTargetIsResolved(target) && (referencedType == null || referencedType instanceof ResolvedJavaType)) {
             ValueNode[] args = frameState.popArguments(target.getSignature().getParameterCount(true));
-            appendInvoke(InvokeKind.Interface, (ResolvedJavaMethod) target, args);
+            Invoke invoke = appendInvoke(InvokeKind.Interface, (ResolvedJavaMethod) target, args);
+            if (invoke != null) {
+                invoke.callTarget().setReferencedType((ResolvedJavaType) referencedType);
+            }
         } else {
             handleUnresolvedInvoke(target, InvokeKind.Interface);
         }
@@ -4336,6 +4341,16 @@ public class BytecodeParser implements GraphBuilderContext {
         return constantPool.lookupMethod(cpi, opcode);
     }
 
+    protected JavaType lookupReferencedTypeInPool(int cpi, int opcode) {
+        if (GraalServices.hasLookupReferencedType()) {
+            return GraalServices.lookupReferencedType(constantPool, cpi, opcode);
+        }
+        // Returning null means that we should not attempt using CHA to devirtualize or inline
+        // interface calls. This is a normal behavior if the JVMCI doesn't support
+        // {@code ConstantPool.lookupReferencedType()}.
+        return null;
+    }
+
     protected JavaField lookupField(int cpi, int opcode) {
         maybeEagerlyResolve(cpi, opcode);
         JavaField result = constantPool.lookupField(cpi, method, opcode);

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.nodes/src/org/graalvm/compiler/nodes/CallTargetNode.java

@@ -79,6 +79,46 @@ public abstract class CallTargetNode extends ValueNode implements LIRLowerable {
 
     @Input protected NodeInputList<ValueNode> arguments;
     protected ResolvedJavaMethod targetMethod;
+
+    /**
+     * Receiver type referenced at the interface call site.
+     *
+     * We need to distinguish the declaring type from the type referenced at the call site. We must
+     * use the referenced type as lower type bound when doing CHA since interface calls must throw
+     * exception if the receiver type is not a subtype of the reference type.
+     *
+     * Example:
+     *
+     * <pre>
+     * interface I1 {
+     *     void foo();
+     * }
+     *
+     * interface I2 extends I1 {
+     * }
+     *
+     * void bar(I2 o) {
+     *     o.foo();
+     * }
+     * </pre>
+     *
+     * Here at the call site the declaring type for {@code foo()} is {@code I1}, while the
+     * referenced type is {@code I2}. Only receivers of type {@code T} that is {@code T <: I2}
+     * should be allowed at the call site. If they are not - an exception should be thrown.
+     *
+     * Since the interface types are not verified, another way to think about this call site is to
+     * rewrite it as follows:
+     *
+     * <pre>
+     * void bar(Object o) {
+     *     ((I2) o).foo();
+     * }
+     * </pre>
+     *
+     * So, in case the receiver is not a subtype of {@code I2} an exception is thrown.
+     */
+    protected ResolvedJavaType referencedType;
+
     protected InvokeKind invokeKind;
     protected final StampPair returnStamp;
 
@@ -117,8 +157,8 @@ public abstract class CallTargetNode extends ValueNode implements LIRLowerable {
         // nop
     }
 
-    public void setTargetMethod(ResolvedJavaMethod method) {
+    public void setTargetMethod(ResolvedJavaMethod targetMethod) {
-        targetMethod = method;
+        this.targetMethod = targetMethod;
     }
 
     /**
@@ -130,6 +170,14 @@ public abstract class CallTargetNode extends ValueNode implements LIRLowerable {
         return targetMethod;
     }
 
+    public void setReferencedType(ResolvedJavaType referencedType) {
+        this.referencedType = referencedType;
+    }
+
+    public ResolvedJavaType referencedType() {
+        return referencedType;
+    }
+
     public InvokeKind invokeKind() {
         return invokeKind;
     }

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.nodes/src/org/graalvm/compiler/nodes/java/MethodCallTargetNode.java

@@ -196,13 +196,16 @@ public class MethodCallTargetNode extends CallTargetNode implements IterableNode
 
         // try to turn a interface call into a virtual call
         ResolvedJavaType declaredReceiverType = targetMethod.getDeclaringClass();
-
+        ResolvedJavaType referencedReceiverType = callTarget.referencedType();
+        if (referencedReceiverType != null) {
             /*
              * We need to check the invoke kind to avoid recursive simplification for virtual interface
              * methods calls.
              */
             if (declaredReceiverType.isInterface()) {
-            ResolvedJavaType singleImplementor = declaredReceiverType.getSingleImplementor();
+                ResolvedJavaType singleImplementor = referencedReceiverType.getSingleImplementor();
+                // If singleImplementor is equal to declaredReceiverType it means that there are
+                // multiple implementors.
                 if (singleImplementor != null && !singleImplementor.equals(declaredReceiverType)) {
                     TypeReference speculatedType = TypeReference.createTrusted(assumptions, singleImplementor);
                     MethodCallTargetNode callTargetResult = tryCheckCastSingleImplementor(receiver, targetMethod, profile, contextType, speculatedType, insertionPoint, callTarget);
@@ -217,7 +220,7 @@ public class MethodCallTargetNode extends CallTargetNode implements IterableNode
                 Stamp uncheckedStamp = uncheckedInterfaceProvider.uncheckedStamp();
                 if (uncheckedStamp != null) {
                     TypeReference speculatedType = StampTool.typeReferenceOrNull(uncheckedStamp);
-                if (speculatedType != null) {
+                    if (speculatedType != null && referencedReceiverType.isAssignableFrom(speculatedType.getType())) {
                         MethodCallTargetNode callTargetResult = tryCheckCastSingleImplementor(receiver, targetMethod, profile, contextType, speculatedType, insertionPoint, callTarget);
                         if (callTargetResult != null) {
                             return callTargetResult;
@@ -225,6 +228,7 @@ public class MethodCallTargetNode extends CallTargetNode implements IterableNode
                     }
                 }
             }
+        }
         return callTarget;
     }
 
@@ -240,7 +244,7 @@ public class MethodCallTargetNode extends CallTargetNode implements IterableNode
                  * with an invoke virtual.
                  *
                  * To do so we need to ensure two properties: 1) the receiver must implement the
-                 * interface (declaredReceiverType). The verifier does not prove this so we need a
+                 * interface (referencedReceiverType). The verifier does not prove this so we need a
                  * dynamic check. 2) we need to ensure that there is still only one implementor of
                  * this interface, i.e. that we are calling the right method. We could do this with
                  * an assumption but as we need an instanceof check anyway we can verify both

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.phases.common/src/org/graalvm/compiler/phases/common/inlining/walker/InliningData.java

@@ -234,6 +234,7 @@ public class InliningData {
             }
         }
 
+        if (invokeKind != InvokeKind.Interface) {
             AssumptionResult<ResolvedJavaType> leafConcreteSubtype = holder.findLeafConcreteSubtype();
             if (leafConcreteSubtype != null) {
                 ResolvedJavaMethod resolvedMethod = leafConcreteSubtype.getResult().resolveConcreteMethod(targetMethod, contextType);
@@ -246,6 +247,7 @@ public class InliningData {
             if (concrete != null && concrete.canRecordTo(callTarget.graph().getAssumptions())) {
                 return getAssumptionInlineInfo(invoke, concrete.getResult(), concrete);
             }
+        }
 
         // type check based inlining
         return getTypeCheckedInlineInfo(invoke, targetMethod);

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.replacements/src/org/graalvm/compiler/replacements/classfile/ClassfileConstantPool.java

@@ -45,12 +45,15 @@ import jdk.vm.ci.meta.JavaType;
 import jdk.vm.ci.meta.ResolvedJavaMethod;
 import jdk.vm.ci.meta.Signature;
 
-class ClassfileConstantPool implements ConstantPool {
+class ClassfileConstantPool implements ConstantPool, ConstantPoolPatch {
 
     final ClassfileConstant[] entries;
     final ClassfileBytecodeProvider context;
 
     public static class Bytecodes {
+        public static final int LDC = 18; // 0x12
+        public static final int LDC_W = 19; // 0x13
+        public static final int LDC2_W = 20; // 0x14
         public static final int GETSTATIC = 178; // 0xB2
         public static final int PUTSTATIC = 179; // 0xB3
         public static final int GETFIELD = 180; // 0xB4
@@ -60,6 +63,12 @@ class ClassfileConstantPool implements ConstantPool {
         public static final int INVOKESTATIC = 184; // 0xB8
         public static final int INVOKEINTERFACE = 185; // 0xB9
         public static final int INVOKEDYNAMIC = 186; // 0xBA
+        public static final int NEW = 187; // 0xBB
+        public static final int NEWARRAY = 188; // 0xBC
+        public static final int ANEWARRAY = 189; // 0xBD
+        public static final int CHECKCAST = 192; // 0xC0
+        public static final int INSTANCEOF = 193; // 0xC1
+        public static final int MULTIANEWARRAY = 197; // 0xC5
     }
 
     ClassfileConstantPool(DataInputStream stream, ClassfileBytecodeProvider context) throws IOException {
@@ -160,6 +169,35 @@ class ClassfileConstantPool implements ConstantPool {
         return get(ClassRef.class, index).resolve(this);
     }
 
+    @Override
+    public JavaType lookupReferencedType(int index, int opcode) {
+        switch (opcode) {
+            case Bytecodes.CHECKCAST:
+            case Bytecodes.INSTANCEOF:
+            case Bytecodes.NEW:
+            case Bytecodes.ANEWARRAY:
+            case Bytecodes.MULTIANEWARRAY:
+            case Bytecodes.LDC:
+            case Bytecodes.LDC_W:
+            case Bytecodes.LDC2_W:
+                return get(ClassRef.class, index).resolve(this);
+            case Bytecodes.GETSTATIC:
+            case Bytecodes.PUTSTATIC:
+            case Bytecodes.GETFIELD:
+            case Bytecodes.PUTFIELD:
+                FieldRef f = get(FieldRef.class, index);
+                return get(ClassRef.class, f.classIndex).resolve(this);
+            case Bytecodes.INVOKEVIRTUAL:
+            case Bytecodes.INVOKESPECIAL:
+            case Bytecodes.INVOKESTATIC:
+            case Bytecodes.INVOKEINTERFACE:
+                ExecutableRef e = get(ExecutableRef.class, index);
+                return get(ClassRef.class, e.classIndex).resolve(this);
+            default:
+                throw GraalError.shouldNotReachHere("Unexpected opcode: " + opcode);
+        }
+    }
+
     @Override
     public String lookupUtf8(int index) {
         return ((Utf8) entries[index]).value;

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.replacements/src/org/graalvm/compiler/replacements/classfile/ConstantPoolPatch.java

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+package org.graalvm.compiler.replacements.classfile;
+
+import jdk.vm.ci.meta.JavaType;
+
+public interface ConstantPoolPatch {
+    JavaType lookupReferencedType(int index, int opcode);
+}

src/jdk.internal.vm.compiler/share/classes/org.graalvm.compiler.serviceprovider/src/org/graalvm/compiler/serviceprovider/GraalServices.java

@@ -28,6 +28,7 @@ import static java.lang.Thread.currentThread;
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.lang.reflect.Method;
 import java.util.Arrays;
 import java.util.ArrayList;
 import java.util.HashMap;
@@ -39,6 +40,8 @@ import java.util.ServiceLoader;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Supplier;
 
+import jdk.vm.ci.meta.ConstantPool;
+import jdk.vm.ci.meta.JavaType;
 import org.graalvm.compiler.serviceprovider.SpeculationReasonGroup.SpeculationContextObject;
 
 import jdk.vm.ci.code.BytecodePosition;
@@ -558,4 +561,33 @@ public final class GraalServices {
     public static int getJavaUpdateVersion() {
         return Runtime.version().update();
     }
+
+    private static final Method constantPoolLookupReferencedType;
+
+    static {
+        Method lookupReferencedType = null;
+        Class<?> constantPool = ConstantPool.class;
+        try {
+            lookupReferencedType = constantPool.getDeclaredMethod("lookupReferencedType", Integer.TYPE, Integer.TYPE);
+        } catch (NoSuchMethodException e) {
+        }
+        constantPoolLookupReferencedType = lookupReferencedType;
+    }
+
+    public static JavaType lookupReferencedType(ConstantPool constantPool, int cpi, int opcode) {
+        if (constantPoolLookupReferencedType != null) {
+            try {
+                return (JavaType) constantPoolLookupReferencedType.invoke(constantPool, cpi, opcode);
+            } catch (Error e) {
+                throw e;
+            } catch (Throwable throwable) {
+                throw new InternalError(throwable);
+            }
+        }
+        throw new InternalError("This JVMCI version doesn't support ConstantPool.lookupReferencedType()");
+    }
+
+    public static boolean hasLookupReferencedType() {
+        return constantPoolLookupReferencedType != null;
+    }
 }

src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/AbstractIndexWriter.java

@@ -317,11 +317,9 @@ public class AbstractIndexWriter extends HtmlDocletWriter {
      * @throws DocFileIOException if there is a problem creating any of the search index files
      */
     protected void createSearchIndexFiles() throws DocFileIOException {
-        if (configuration.showModules) {
         createSearchIndexFile(DocPaths.MODULE_SEARCH_INDEX_JS,
                               searchItems.itemsOfCategories(Category.MODULES),
                               "moduleSearchIndex");
-        }
         if (!configuration.packages.isEmpty()) {
             SearchIndexItem si = new SearchIndexItem();
             si.setCategory(Category.PACKAGES);
@@ -364,7 +362,6 @@ public class AbstractIndexWriter extends HtmlDocletWriter {
         // The file needs to be created even if there are no searchIndex items
         // File could be written straight-through, without an intermediate StringBuilder
         Iterator<SearchIndexItem> index = searchIndex.iterator();
-        if (index.hasNext()) {
         StringBuilder searchVar = new StringBuilder("[");
         boolean first = true;
         while (index.hasNext()) {
@@ -376,17 +373,17 @@ public class AbstractIndexWriter extends HtmlDocletWriter {
                 searchVar.append(",").append(item.toString());
             }
         }
-            searchVar.append("]");
+        searchVar.append("];");
         DocFile jsFile = DocFile.createFileForOutput(configuration, searchIndexJS);
         try (Writer wr = jsFile.openWriter()) {
             wr.write(varName);
             wr.write(" = ");
             wr.write(searchVar.toString());
+            wr.write("updateSearchResults();");
         } catch (IOException ie) {
             throw new DocFileIOException(jsFile, DocFileIOException.Mode.WRITE, ie);
         }
     }
-    }
 
     private static Map<Character, List<SearchIndexItem>> buildSearchTagIndex(
             Stream<? extends SearchIndexItem> searchItems)

src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/formats/html/resources/search.js

@@ -24,6 +24,7 @@
  */
 
 var noResult = {l: "No results found"};
+var loading = {l: "Loading search index..."};
 var catModules = "Modules";
 var catPackages = "Packages";
 var catTypes = "Types";
@@ -219,11 +220,7 @@ function rankMatch(match, category) {
     return leftBoundaryMatch + periferalMatch + (delta / 200);
 
 }
-$(function() {
+function doSearch(request, response) {
-    $("#search").catcomplete({
-        minLength: 1,
-        delay: 300,
-        source: function(request, response) {
     var result = [];
     var newResults = [];
 
@@ -307,8 +304,21 @@ $(function() {
         });
         result = concatResults(result, newResults);
     }
+    if (!indexFilesLoaded()) {
+        updateSearchResults = function() {
+            doSearch(request, response);
+        }
+        result.unshift(loading);
+    } else {
+        updateSearchResults = function() {};
+    }
     response(result);
-        },
+}
+$(function() {
+    $("#search").catcomplete({
+        minLength: 1,
+        delay: 300,
+        source: doSearch,
         response: function(event, ui) {
             if (!ui.content.length) {
                 ui.content.push(noResult);

src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/toolkit/resources/script.js

@@ -91,3 +91,13 @@ function switchTab(e) {
         e.preventDefault();
     }
 }
+
+var updateSearchResults = function() {};
+
+function indexFilesLoaded() {
+    return moduleSearchIndex
+        && packageSearchIndex
+        && typeSearchIndex
+        && memberSearchIndex
+        && tagSearchIndex;
+}

src/jdk.zipfs/share/classes/jdk/nio/zipfs/ZipFileSystem.java

@@ -1550,7 +1550,8 @@ class ZipFileSystem extends FileSystem {
             int nlen   = CENNAM(cen, pos);
             int elen   = CENEXT(cen, pos);
             int clen   = CENCOM(cen, pos);
-            if ((CENFLG(cen, pos) & 1) != 0) {
+            int flag   = CENFLG(cen, pos);
+            if ((flag & 1) != 0) {
                 throw new ZipException("invalid CEN header (encrypted entry)");
             }
             if (method != METHOD_STORED && method != METHOD_DEFLATED) {
@@ -1561,7 +1562,11 @@ class ZipFileSystem extends FileSystem {
             }
             IndexNode inode = new IndexNode(cen, pos, nlen);
             inodes.put(inode, inode);
-
+            if (zc.isUTF8() || (flag & FLAG_USE_UTF8) != 0) {
+                checkUTF8(inode.name);
+            } else {
+                checkEncoding(inode.name);
+            }
             // skip ext and comment
             pos += (CENHDR + nlen + elen + clen);
         }
@@ -1572,6 +1577,34 @@ class ZipFileSystem extends FileSystem {
         return cen;
     }
 
+    private  final void checkUTF8(byte[] a) throws ZipException {
+        try {
+            int end = a.length;
+            int pos = 0;
+            while (pos < end) {
+                // ASCII fast-path: When checking that a range of bytes is
+                // valid UTF-8, we can avoid some allocation by skipping
+                // past bytes in the 0-127 range
+                if (a[pos] < 0) {
+                    zc.toString(Arrays.copyOfRange(a, pos, a.length));
+                    break;
+                }
+                pos++;
+            }
+        } catch(Exception e) {
+            throw new ZipException("invalid CEN header (bad entry name)");
+        }
+    }
+
+    private final void checkEncoding( byte[] a) throws ZipException {
+        try {
+            zc.toString(a);
+        } catch(Exception e) {
+            throw new ZipException("invalid CEN header (bad entry name)");
+        }
+    }
+
+
     private void ensureOpen() {
         if (!isOpen)
             throw new ClosedFileSystemException();

test/hotspot/jtreg/vmTestbase/metaspace/gc/firstGC_10m/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,6 @@
  * VM Testbase comments: 8208250
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xms200m
  *      -Xlog:gc+heap=trace,gc:gc.log

test/hotspot/jtreg/vmTestbase/metaspace/gc/firstGC_50m/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,6 @@
  * VM Testbase comments: 8208250
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xms200m
  *      -Xlog:gc+heap=trace,gc:gc.log

test/hotspot/jtreg/vmTestbase/metaspace/gc/firstGC_99m/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,6 @@
  * VM Testbase comments: 8208250
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xms200m
  *      -Xlog:gc+heap=trace,gc:gc.log

test/hotspot/jtreg/vmTestbase/metaspace/gc/firstGC_default/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,6 @@
  * VM Testbase comments: 8208250
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xms200m
  *      -Xlog:gc+heap=trace,gc:gc.log

test/hotspot/jtreg/vmTestbase/metaspace/gc/memoryUsageLargeComp/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,6 @@
  * VM Testbase keywords: [nonconcurrent]
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xms200m
  *      -XX:MetaspaceSize=100m

test/hotspot/jtreg/vmTestbase/metaspace/gc/memoryUsageLargeMeta/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,6 @@
  * VM Testbase keywords: [nonconcurrent]
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xms200m
  *      -XX:MetaspaceSize=100m

test/hotspot/jtreg/vmTestbase/metaspace/gc/memoryUsageSmallComp/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,6 @@
  * VM Testbase keywords: [nonconcurrent]
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -XX:MaxMetaspaceSize=20M
  *      -XX:MinMetaspaceFreeRatio=10

test/hotspot/jtreg/vmTestbase/metaspace/gc/memoryUsageSmallMeta/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,6 @@
  * VM Testbase keywords: [nonconcurrent]
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -XX:MetaspaceSize=10M
  *      -XX:MinMetaspaceFreeRatio=70

test/hotspot/jtreg/vmTestbase/metaspace/gc/watermark_0_1/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,6 @@
  * @requires vm.gc != "G1" | !vm.opt.final.ClassUnloadingWithConcurrentMark
  * @requires vm.gc != "Z"
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xmx1g
  *      -Xms150m

test/hotspot/jtreg/vmTestbase/metaspace/gc/watermark_10_20/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,6 @@
  * @requires vm.gc != "G1" | !vm.opt.final.ClassUnloadingWithConcurrentMark
  * @requires vm.gc != "Z"
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xmx1g
  *      -Xms150m

test/hotspot/jtreg/vmTestbase/metaspace/gc/watermark_70_80/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,6 @@
  * @requires vm.gc != "G1" | !vm.opt.final.ClassUnloadingWithConcurrentMark
  * @requires vm.gc != "Z"
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xmx1g
  *      -Xms150m

test/hotspot/jtreg/vmTestbase/metaspace/gc/watermark_99_100/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,7 +34,6 @@
  * @requires vm.gc != "G1" | !vm.opt.final.ClassUnloadingWithConcurrentMark
  * @requires vm.gc != "Z"
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -Xmx1g
  *      -Xms150m

test/hotspot/jtreg/vmTestbase/metaspace/shrink_grow/CompressedClassSpaceSize/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -DrequiresCompressedClassSpace=true
  *      -XX:MaxMetaspaceSize=100m

test/hotspot/jtreg/vmTestbase/metaspace/shrink_grow/ShrinkGrowMultiJVM/ShrinkGrowMultiJVM.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build metaspace.shrink_grow.ShrinkGrowMultiJVM.ShrinkGrowMultiJVM
  * @run driver metaspace.shrink_grow.ShrinkGrowMultiJVM.ShrinkGrowMultiJVM
  */

test/hotspot/jtreg/vmTestbase/metaspace/shrink_grow/ShrinkGrowTest/ShrinkGrowTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013, 2019, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2013, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,7 +30,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm
  *      -XX:MetaspaceSize=10m
  *      -XX:MaxMetaspaceSize=20m

test/hotspot/jtreg/vmTestbase/metaspace/staticReferences/StaticReferences.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressDictionary/StressDictionary.java

@@ -29,7 +29,6 @@
  * VM Testbase keywords: [nonconcurrent, javac]
  *
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @run main/othervm/timeout=420 metaspace.stressDictionary.StressDictionary -stressTime 30
  */
 

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy001/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy002/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy003/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy004/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy005/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy006/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy007/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @comment generate and compile metaspace.stressHierarchy.common.HumongousClass

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy008/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @comment generate and compile metaspace.stressHierarchy.common.HumongousClass

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy009/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @comment generate and compile metaspace.stressHierarchy.common.HumongousClass

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy010/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @comment generate and compile metaspace.stressHierarchy.common.HumongousClass

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy011/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @comment generate and compile metaspace.stressHierarchy.common.HumongousClass

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy012/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @comment generate and compile metaspace.stressHierarchy.common.HumongousClass

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy013/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy014/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/metaspace/stressHierarchy/stressHierarchy015/TestDescription.java

@@ -31,7 +31,6 @@
  *
  * @requires vm.opt.final.ClassUnloading
  * @library /vmTestbase /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build sun.hotspot.WhiteBox
  * @run driver ClassFileInstaller sun.hotspot.WhiteBox
  * @run main/othervm

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ArrayReference/GetValues/getvalues001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -57,7 +57,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ArrayReference.GetValues.getvalues001
  *        nsk.jdwp.ArrayReference.GetValues.getvalues001a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ArrayReference/GetValues/getvalues002/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ArrayReference.GetValues.getvalues002
  *        nsk.jdwp.ArrayReference.GetValues.getvalues002a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ArrayReference/Length/length001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -56,7 +56,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ArrayReference.Length.length001
  *        nsk.jdwp.ArrayReference.Length.length001a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ArrayReference/SetValues/setvalues001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ArrayReference.SetValues.setvalues001
  *        nsk.jdwp.ArrayReference.SetValues.setvalues001a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ArrayType/NewInstance/newinstance001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -54,7 +54,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ArrayType.NewInstance.newinstance001
  *        nsk.jdwp.ArrayType.NewInstance.newinstance001a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ClassLoaderReference/VisibleClasses/visibclasses001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -56,7 +56,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ClassLoaderReference.VisibleClasses.visibclasses001
  *        nsk.jdwp.ClassLoaderReference.VisibleClasses.visibclasses001a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ClassObjectReference/ReflectedType/reflectype001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ClassObjectReference.ReflectedType.reflectype001
  *        nsk.jdwp.ClassObjectReference.ReflectedType.reflectype001a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ClassType/InvokeMethod/invokemeth001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ClassType.InvokeMethod.invokemeth001
  *        nsk.jdwp.ClassType.InvokeMethod.invokemeth001a
  * @run main/othervm PropertyResolvingWrapper

test/hotspot/jtreg/vmTestbase/nsk/jdwp/ClassType/NewInstance/newinst001/TestDescription.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2020, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -59,7 +59,6 @@
  *
  * @library /vmTestbase /test/hotspot/jtreg/vmTestbase
  *          /test/lib
- * @run driver jdk.test.lib.FileInstaller . .
  * @build nsk.jdwp.ClassType.NewInstance.newinst001
  *        nsk.jdwp.ClassType.NewInstance.newinst001a
  * @run main/othervm PropertyResolvingWrapper