RELEASE NOTES FOR: 12 ==================================================================================================== Notes generated: Wed Sep 01 03:43:35 CEST 2021 Hint: Prefix bug IDs with https://bugs.openjdk.java.net/browse/ to reach the relevant JIRA entry. JAVA ENHANCEMENT PROPOSALS (JEP): JEP 189: Shenandoah: A Low-Pause-Time Garbage Collector (Experimental) Add a new garbage collection (GC) algorithm named Shenandoah which reduces GC pause times by doing evacuation work concurrently with the running Java threads. Pause times with Shenandoah are independent of heap size, meaning you will have the same consistent pause times whether your heap is 200 MB or 200 GB. JEP 230: Microbenchmark Suite Add a basic suite of microbenchmarks to the JDK source code, and make it easy for developers to run existing microbenchmarks and create new ones. JEP 325: Switch Expressions (Preview) Extend the `switch` statement so that it can be used as either a statement or an expression, and that both forms can use either a "traditional" or "simplified" scoping and control flow behavior. These changes will simplify everyday coding, and also prepare the way for the use of [pattern matching (JEP 305)](http://openjdk.java.net/jeps/305) in `switch`. This is a [preview language feature](http://openjdk.java.net/jeps/12) in JDK 12. JEP 334: JVM Constants API Introduce an API to model nominal descriptions of key class-file and run-time artifacts, in particular constants that are loadable from the constant pool. JEP 340: One AArch64 Port, Not Two Remove all of the sources related to the `arm64` port while retaining the 32-bit ARM port and the 64-bit `aarch64` port. JEP 341: Default CDS Archives Enhance the JDK build process to generate a class data-sharing (CDS) archive, using the default class list, on 64-bit platforms. JEP 344: Abortable Mixed Collections for G1 Make G1 mixed collections abortable if they might exceed the pause target. JEP 346: Promptly Return Unused Committed Memory from G1 Enhance the G1 garbage collector to automatically return Java heap memory to the operating system when idle. RELEASE NOTES, BY COMPONENT: tools/javac: JDK-8219875: Removal of javac Support for 6/1.6 source, target, and release Values Consistent with the policy outlined in [JEP 182: Policy for Retiring javac -source and -target Options](https://openjdk.java.net/jeps/182), support for the 6/1.6 argument value for javac's `-source`, `-target`, and `--release` flags has been removed. core-libs/java.util: JDK-8214820: Changed Properties.loadFromXML to Comply with Specification The implementation of the `java.util.Properties.loadFromXML` method has been changed to comply with its specification. Specifically, the underlying XML parser implementation now rejects non-compliant XML documents by throwing an `InvalidPropertiesFormatException` as specified by the `loadFromXML` method. The effect of the change is as follows: - Documents created by `Properties.storeToXML`: No change. `Properties.loadFromXML` will have no problem reading such files. - Documents not created by `Properties.storeToXML`: Any documents containing DTDs not in the format as specified in `Properties.loadFromXML` will be rejected. This means the DTD shall be exactly as follows (as generated by the `Properties.storeToXML` method): ``` ``` core-libs/java.net: JDK-8213945: Changed URLPermission Behavior with Query or Fragments in URL String The behavior of `java.net.URLPermission` has changed slightly. It was previously specified to ignore query and fragment components in the supplied URL string. However, this behavior was not implemented and any query or fragment were included in the internal permission URL string. The change here is to implement the behavior as specified. Internal usages of `URLPermission` in the JDK do not include queries or fragments. So, this will not change. In the unlikely event that user code was creating `URLPermission` objects explicitly, then the behavior change may be seen and that permission checks which failed erroneously previously, will now pass as expected. hotspot/jvmti: JDK-8218594: can_pop_frame and can_force_early_return Capabilities are Disabled if JVMCI Compiler is Used The JVMTI `can_pop_frame` and `can_force_early_return` capabilities are disabled if a JVMCI compiler (like Graal) is used. As a result the corresponding functionality (`PopFrame` and `ForceEarlyReturnXXX` functions) is not available to JVMTI agents. This issue is tracked by [JDK-8218885](https://bugs.openjdk.java.net/browse/JDK-8218885). core-libs/java.util:i18n: JDK-8211934: Square Character Support for Japanese New Era The code point, U+32FF, is reserved by the Unicode Consortium to represent the Japanese square character for the new era that begins from May, 2019. Relevant methods in the `Character` class return the same properties as the existing Japanese era characters (e.g., U+337E for "Meizi"). For details about the code point, see [http://blog.unicode.org/2018/09/new-japanese-era.html](http://blog.unicode.org/2018/09/new-japanese-era.html). core-libs/java.lang: JDK-8214454: POSIX_SPAWN Option on Linux As an additional way to launch processes on Linux, the `jdk.lang.Process.launchMechanism` property can be set to `POSIX_SPAWN`. This option has been available for a long time on other *nix platforms. The default launch mechanism (`VFORK`) on Linux is unchanged, so this additional option does not affect existing installations. `POSIX_SPAWN` mitigates rare pathological cases when spawning child processes, but it has not yet been excessively tested. Prudence is advised when using `POSIX_SPAWN` in productive installations. JDK-8213629: Initial Value of user.timezone System Property Changed The initial value of the ```user.timezone``` system property is undefined unless set using a command line argument, for example, ```-Duser.timezone="America/New_York"```. The first time the default timezone is needed, if `user.timezone` is undefined or empty the timezone provided by the operating system is used. Previously, the initial value was the empty string. In JDK 12, `System.getProperty("user.timezone")` may return null. JDK-8214454: POSIX_SPAWN Option on Linux As an additional way to launch processes on Linux, the `jdk.lang.Process.launchMechanism` property can be set to `POSIX_SPAWN`. This option has been available for a long time on other *nix platforms. The default launch mechanism (`VFORK`) on Linux is unchanged, so this additional option does not affect existing installations. `POSIX_SPAWN` mitigates rare pathological cases when spawning child processes, but it has not yet been excessively tested. Prudence is advised when using `POSIX_SPAWN` in productive installations. JDK-8213629: Initial Value of user.timezone System Property Changed The initial value of the ```user.timezone``` system property is undefined unless set using a command line argument, for example, ```-Duser.timezone="America/New_York"```. The first time the default timezone is needed, if `user.timezone` is undefined or empty the timezone provided by the operating system is used. Previously, the initial value was the empty string. In JDK 12, `System.getProperty("user.timezone")` may return null. specification/language: JDK-8218616: JEP 325: Switch Expressions (Preview) The Java language enhances the `switch` statement so that it can be used as either a statement or an expression. Using `switch` as an expression often results in code that is more concise and readable. Both the statement and expression form can use either traditional `case ... :` labels (with fall through) or simplified `case ... ->` labels (no fall through). Also, both forms can switch on multiple constants in one case. These enhancements to `switch` are a [preview language feature](http://openjdk.java.net/jeps/12). hotspot/runtime: JDK-8214732: Obsoleted -XX:+/-MonitorInUseLists The VM Option `-XX:-MonitorInUseLists` is obsolete in JDK 12 and ignored. Use of this flag will result in a warning being issued. This option may be removed completely in a future release. JDK-8188105: Make -Xshare:auto the default for server VM We expect CDS to be widely used with the Server VM. However, the current default CDS setting for Server VM is -Xshare:off. This makes it cumbersome to use CDS. We should change the default to -Xshare:auto, so as long as a CDS archive exists in the JDK, CDS will be automatically used without specifying extra flags. In JDK 8 and before, RewriteBytecodes was disabled when CDS was enabled. This caused performance degradation in the Server Compiler (aka C2). However this has been fixed in JDK-8074345 since JDK 9, so there's no longer need to disable CDS by default with the Server VM. The proposed change is to remove this block of code http://hg.openjdk.java.net/jdk/hs/file/eebf559c9e0d/src/hotspot/share/runtime/arguments.cpp#l1819 #if COMPILER2_OR_JVMCI // Shared spaces work fine with other GCs but causes bytecode rewriting // to be disabled, which hurts interpreter performance and decreases // server performance. When -server is specified, keep the default off // unless it is asked for. Future work: either add bytecode rewriting // at link time, or rewrite bytecodes in non-shared methods. if (is_server_compilation_mode_vm() && !DumpSharedSpaces && !RequireSharedSpaces && (FLAG_IS_DEFAULT(UseSharedSpaces) || !UseSharedSpaces)) { no_shared_spaces("COMPILER2 default: -Xshare:auto | off, have to manually setup to on."); } #endif JDK-8214160: Command-Line Flag -XX:+ExtensiveErrorReports The command-line flag `-XX:+ExtensiveErrorReports` has been added to allow more extensive reporting of information related to a crash as reported in the `hs_err.log` file. Disabled by default in product builds, the flag can be turned on in environments where maximal information is desired - even if the resulting logs may be quite large and/or contain information that might be considered sensitive. JDK-8214732: Obsoleted -XX:+/-MonitorInUseLists The VM Option `-XX:-MonitorInUseLists` is obsolete in JDK 12 and ignored. Use of this flag will result in a warning being issued. This option may be removed completely in a future release. JDK-8188105: Make -Xshare:auto the default for server VM We expect CDS to be widely used with the Server VM. However, the current default CDS setting for Server VM is -Xshare:off. This makes it cumbersome to use CDS. We should change the default to -Xshare:auto, so as long as a CDS archive exists in the JDK, CDS will be automatically used without specifying extra flags. In JDK 8 and before, RewriteBytecodes was disabled when CDS was enabled. This caused performance degradation in the Server Compiler (aka C2). However this has been fixed in JDK-8074345 since JDK 9, so there's no longer need to disable CDS by default with the Server VM. The proposed change is to remove this block of code http://hg.openjdk.java.net/jdk/hs/file/eebf559c9e0d/src/hotspot/share/runtime/arguments.cpp#l1819 #if COMPILER2_OR_JVMCI // Shared spaces work fine with other GCs but causes bytecode rewriting // to be disabled, which hurts interpreter performance and decreases // server performance. When -server is specified, keep the default off // unless it is asked for. Future work: either add bytecode rewriting // at link time, or rewrite bytecodes in non-shared methods. if (is_server_compilation_mode_vm() && !DumpSharedSpaces && !RequireSharedSpaces && (FLAG_IS_DEFAULT(UseSharedSpaces) || !UseSharedSpaces)) { no_shared_spaces("COMPILER2 default: -Xshare:auto | off, have to manually setup to on."); } #endif JDK-8214160: Command-Line Flag -XX:+ExtensiveErrorReports The command-line flag `-XX:+ExtensiveErrorReports` has been added to allow more extensive reporting of information related to a crash as reported in the `hs_err.log` file. Disabled by default in product builds, the flag can be turned on in environments where maximal information is desired - even if the resulting logs may be quite large and/or contain information that might be considered sensitive. JDK-8214732: Obsoleted -XX:+/-MonitorInUseLists The VM Option `-XX:-MonitorInUseLists` is obsolete in JDK 12 and ignored. Use of this flag will result in a warning being issued. This option may be removed completely in a future release. JDK-8188105: Make -Xshare:auto the default for server VM We expect CDS to be widely used with the Server VM. However, the current default CDS setting for Server VM is -Xshare:off. This makes it cumbersome to use CDS. We should change the default to -Xshare:auto, so as long as a CDS archive exists in the JDK, CDS will be automatically used without specifying extra flags. In JDK 8 and before, RewriteBytecodes was disabled when CDS was enabled. This caused performance degradation in the Server Compiler (aka C2). However this has been fixed in JDK-8074345 since JDK 9, so there's no longer need to disable CDS by default with the Server VM. The proposed change is to remove this block of code http://hg.openjdk.java.net/jdk/hs/file/eebf559c9e0d/src/hotspot/share/runtime/arguments.cpp#l1819 #if COMPILER2_OR_JVMCI // Shared spaces work fine with other GCs but causes bytecode rewriting // to be disabled, which hurts interpreter performance and decreases // server performance. When -server is specified, keep the default off // unless it is asked for. Future work: either add bytecode rewriting // at link time, or rewrite bytecodes in non-shared methods. if (is_server_compilation_mode_vm() && !DumpSharedSpaces && !RequireSharedSpaces && (FLAG_IS_DEFAULT(UseSharedSpaces) || !UseSharedSpaces)) { no_shared_spaces("COMPILER2 default: -Xshare:auto | off, have to manually setup to on."); } #endif JDK-8214160: Command-Line Flag -XX:+ExtensiveErrorReports The command-line flag `-XX:+ExtensiveErrorReports` has been added to allow more extensive reporting of information related to a crash as reported in the `hs_err.log` file. Disabled by default in product builds, the flag can be turned on in environments where maximal information is desired - even if the resulting logs may be quite large and/or contain information that might be considered sensitive. security-libs/java.security: JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate JDK-8207255: Removal of AOL and Swisscom Root Certificates The following root certificates have been removed from the cacerts truststore: + AOL + aolrootca1 DN: CN=America Online Root Certification Authority 1, O=America Online Inc., C=US + aolrootca2 DN: CN=America Online Root Certification Authority 2, O=America Online Inc., C=US + Swisscom + swisscomrootca2 DN: CN=Swisscom Root CA 2, OU=Digital Certificate Services, O=Swisscom, C=ch JDK-8212691: Removal of GTE CyberTrust Global Root The GTE CyberTrust Global Root certificate is expired and has been removed from the `cacerts` keystore: + alias name "gtecybertrustglobalca [jdk]" Distinguished Name: CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US JDK-8215293: Customizing PKCS12 keystore Generation New system and security properties have been added to enable users to customize the generation of PKCS #12 keystores. This includes algorithms and parameters for key protection, certificate protection, and MacData. The detailed explanation and possible values for these properties can be found in the "PKCS12 KeyStore properties" section of the `java.security` file. Also, support for the following SHA-2 based HmacPBE algorithms has been added to the SunJCE provider: HmacPBESHA224, HmacPBESHA256, HmacPBESHA384, HmacPBESHA512, HmacPBESHA512/224, HmacPBESHA512/256 JDK-8212047: disallow and allow Options for java.security.manager System Property New "disallow" and "allow" token options have been added to the `java.security.manager` system property. In the JDK implementation, if the Java Virtual Machine starts with the system property `java.security.manager` set to "disallow", then the `System.setSecurityManager` method cannot be used to set a security manager and will throw an `UnsupportedOperationException`. The "disallow" option can improve run-time performance for applications that never set a security manager. For further details on the behavior of these options, see the class description of `java.lang.SecurityManager`. JDK-8210436: Added Additional TeliaSonera Root Certificate The following root certificate have been added to the OpenJDK cacerts truststore: + TeliaSonera + teliasonerarootcav1 DN: CN=TeliaSonera Root CA v1, O=TeliaSonera JDK-8213821: -groupname Option Added to keytool Key Pair Generation A new `-groupname` option has been added to `keytool -genkeypair` so that a user can specify a named group when generating a key pair. For example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will generate an EC key pair by using the `secp384r1` curve. Because there might be multiple curves with the same size, using the `-groupname` option is preferred over the `-keysize` option. JDK-8205949: Added Entrust Root Certificates The following root certificates have been added to the OpenJDK cacerts truststore: + Entrust + entrustrootcaec1 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2012 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - EC1 + entrust2048ca DN: O=Entrust.net, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), OU=(c) 1999 Entrust.net Limited, CN=Entrust.net Certification Authority (2048) + entrustrootcag2 DN: C=US, O=Entrust, Inc., OU=See www.entrust.net/legal-terms, OU=(c) 2009 Entrust, Inc. - for authorized use only, CN=Entrust Root Certification Authority - G2 + entrustevca DN: C=US, O=Entrust, Inc., OU=www.entrust.net/CPS is incorporated by reference, OU=(c) 2006 Entrust, Inc., CN=Entrust Root Certification Authority + affirmtrustnetworkingca DN: C=US, O=AffirmTrust, CN=AffirmTrust Networking + affirmtrustpremiumca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium + affirmtrustcommercialca DN: C=US, O=AffirmTrust, CN=AffirmTrust Commercial + affirmtrustpremiumeccca DN: C=US, O=AffirmTrust, CN=AffirmTrust Premium ECC JDK-8213965: Deprecated Default Keytool -keyalg Value The default `-keyalg` value for the `-genkeypair` and `-genseckey` commands of keytool have been deprecated. If a user has not explicitly specified a value for the `-keyalg` option a warning will be shown. An additional informational text will also be printed showing the algorithm(s) used by the newly generated entry. In a subsequent JDK release, the default key algorithm values will no longer be supported and the `-keyalg` option will be required. JDK-8220239: New Java Flight Recorder (JFR) Security Events Four new JFR events have been added to the security library area. These events are disabled by default and can be enabled via the JFR configuration files or via standard JFR options. * `jdk.SecurityPropertyModification` + Records `Security.setProperty(String key, String value)` method calls * `jdk.TLSHandshake` + Records TLS handshake activity. The event fields include: + Peer hostname + Peer port + TLS protocol version negotiated + TLS cipher suite negotiated + Certificate id of peer client * `jdk.X509Validation` + Records details of X.509 certificates negotiated in successful X.509 validation (chain of trust) * `jdk.X509Certificate` + Records details of X.509 Certificates. The event fields include: + Certificate algorithm + Certificate serial number + Certificate subject + Certificate issuer + Key type + Key length + Certificate id + Validity of certificate core-libs/java.time: JDK-8213053: Support New Japanese Era in java.time.chrono.JapaneseEra The JapaneseEra class and its `of(int)`, `valueOf(String)`, and `values()` methods are clarified to accommodate future Japanese era additions, such as how the singleton instances are defined, what the associated integer era values are, etc. docs/guides: JDK-8205932: JEP 335: Deprecate the Nashorn JavaScript Engine Deprecate the Nashorn JavaScript script engine and APIs, and the jjs tool, with the intent to remove them in a future release ([JEP 335](http://openjdk.java.net/jeps/335)). The Nashorn JavaScript Engine implementation, the APIs and the `jjs` shell tool have been deprecated and might be removed in a future release. Code that uses classes and interfaces from `jdk.nashorn.api.scripting` and `jdk.nashorn.api.tree` packages will get a deprecation warning from `javac`. The Nashorn engine (when used by `javax.script` API or `jrunscript` tool) as well as `jjs` shell tool will print a warning message about deprecation. To disable this runtime warning message, users can include the new Nashorn option, `--no-deprecation-warning`. This might be useful for compatibility scripts that depend on exact output (such as, to avoid the warning breaking their expected exact output). security-libs/org.ietf.jgss:krb5: JDK-8211380: Support for dns_canonicalize_hostname in krb5.conf The [`dns_canonicalize_hostname` flag](https://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/krb5_conf.html) in the `krb5.conf` configuration file is now supported by the JDK Kerberos implementation. When set to "true", a short hostname in a service principal name will be canonicalized to a fully qualified domain name if available. Otherwise, no canonicalization is performed. The default value is "true". This is also the behavior before JDK 12. tools: JDK-8214213: jdeps --print-module-deps Reports Transitive Dependences `jdeps --print-module-deps`, `--list-deps`, and `--list-reduce-deps` options have been enhanced as follows. 1. By default, they perform transitive module dependence analysis on libraries on the class path and module path, both directly and indirectly, as required by the given input JAR files or classes. Previously, they only reported the modules required by the given input JAR files or classes. The `--no-recursive` option can be used to request non-transitive dependence analysis. 2. By default, they flag any missing dependency, i.e. not found from class path and module path, as an error. The `--ignore-missing-deps` option can be used to suppress missing dependence errors. Note that a custom image is created with the list of modules output by jdeps when using the `--ignore-missing-deps` option for a non-modular application. Such an application, running on the custom image, might fail at runtime when missing dependence errors are suppressed. core-libs/java.lang.invoke: JDK-8214723: JEP 334: JVM Constants API The new package `java.lang.invoke.constant` introduces an API to model nominal descriptions of class file and run-time artifacts, in particular constants that are loadable from the constant pool. It does so by defining a family of value-based symbolic reference (JVMS 5.1) types, capable of describing each kind of loadable constant. A symbolic reference describes a loadable constant in purely nominal form, separate from class loading or accessibility context. Some classes can act as their own symbolic references (e.g., `String`); for linkable constants a family of symbolic reference types has been added (`ClassDesc`, `MethodTypeDesc`, `MethodHandleDesc`, and `DynamicConstantDesc`) that contain the nominal information to describe these constants. core-libs/java.text: JDK-8214515: Support for Compact Number Formatting `NumberFormat` adds support for formatting a number in its compact form. Compact number formatting refers to the representation of a number in a short or human readable form. For example, in the en_US locale, 1000 can be formatted as "1K" and 1000000 can be formatted as "1M", depending upon the style specified by `NumberFormat.Style`. The compact number formats are defined by LDML's specification for [Compact Number Formats](http://unicode.org/reports/tr35/tr35-numbers.html#Compact_Number_Formats). To obtain an instance, use one of the factory methods given by `NumberFormat` for compact number formatting. For example: ``` NumberFormat fmt = NumberFormat.getCompactNumberInstance(Locale.US, NumberFormat.Style.SHORT); String result = fmt.format(1000); ``` The example above results in "1K". JDK-8213991: Support for Unicode 11 The JDK 12 release includes support for Unicode 11.0.0. Following the release of JDK 11, which supported Unicode 10.0.0, Unicode 11.0.0 introduced the following new features that are now included in JDK 12: - 684 new characters - 11 new blocks - 7 new scripts. 684 new characters that include important additions for the following: - 66 emoji characters - Copyleft symbol - Half stars for rating systems - Additional astrological symbols - Xiangqi Chinese chess symbols 7 new scripts : - Hanifi Rohingya - Old Sogdian - Sogdian - Dogra - Gunjala Gondi - Makasar - Medefaidrin 11 new blocks that include 7 blocks for the new scripts listed above and 4 blocks for the following existing scripts: - Georgian Extended - Mayan Numerals - Indic Siyaq Numbers - Chess Symbols JDK-8214515: Support for Compact Number Formatting `NumberFormat` adds support for formatting a number in its compact form. Compact number formatting refers to the representation of a number in a short or human readable form. For example, in the en_US locale, 1000 can be formatted as "1K" and 1000000 can be formatted as "1M", depending upon the style specified by `NumberFormat.Style`. The compact number formats are defined by LDML's specification for [Compact Number Formats](http://unicode.org/reports/tr35/tr35-numbers.html#Compact_Number_Formats). To obtain an instance, use one of the factory methods given by `NumberFormat` for compact number formatting. For example: ``` NumberFormat fmt = NumberFormat.getCompactNumberInstance(Locale.US, NumberFormat.Style.SHORT); String result = fmt.format(1000); ``` The example above results in "1K". JDK-8213991: Support for Unicode 11 The JDK 12 release includes support for Unicode 11.0.0. Following the release of JDK 11, which supported Unicode 10.0.0, Unicode 11.0.0 introduced the following new features that are now included in JDK 12: - 684 new characters - 11 new blocks - 7 new scripts. 684 new characters that include important additions for the following: - 66 emoji characters - Copyleft symbol - Half stars for rating systems - Additional astrological symbols - Xiangqi Chinese chess symbols 7 new scripts : - Hanifi Rohingya - Old Sogdian - Sogdian - Dogra - Gunjala Gondi - Makasar - Medefaidrin 11 new blocks that include 7 blocks for the new scripts listed above and 4 blocks for the following existing scripts: - Georgian Extended - Mayan Numerals - Indic Siyaq Numbers - Chess Symbols core-libs/javax.naming: JDK-8211745: LDAPS Communication Failure Application code using LDAPS with a socket connect timeout that is <= 0 ( the default value ), may encounter an exception when establishing the connection. The top most frames from Exception stack traces of applications encountering such issues might resemble the following: ``` javax.naming.ServiceUnavailableException: ; socket closed at com.sun.jndi.ldap.Connection.readReply(Unknown Source) at com.sun.jndi.ldap.LdapClient.ldapBind(Unknown Source) ... ``` core-libs/java.util.jar: JDK-8212621: Removal of finalize Method in java.util.ZipFile/Inflator/Deflator The `finalize` method in `java.util.ZipFile`, `java.util.Inflator`, and `java.util.Deflator` was deprecated for removal in JDK 9 and its implementation was updated to be a no-op. The `finalize` method in `java.util.ZipFile`, `java.util.Inflator`, and `java.util.Deflator` has been removed in this release. Subclasses that override `finalize` in order to perform cleanup should be modified to use alternative cleanup mechanisms and to remove the overriding `finalize` method. The removal of the finalize methods will expose `Object.finalize` to subclasses of `ZipFile`, `Deflater`, and `Inflater`. Compilation errors might occur on the override of `finalize` due to the change in declared exceptions. `Object.finalize` is now declared to throw `java.lang.Throwable`. Previously, only `java.io.IOException` was declared. security-libs/javax.net.ssl: JDK-8210799: ChaCha20 and Poly1305 TLS Cipher Suites New TLS cipher suites using the `ChaCha20-Poly1305` algorithm have been added to JSSE. These cipher suites are enabled by default. The TLS_CHACHA20_POLY1305_SHA256 cipher suite is available for TLS 1.3. The following cipher suites are available for TLS 1.2: - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Refer to the "Java Secure Socket Extension (JSSE) Reference Guide" for details on these new TLS cipher suites. JDK-8215012: Distrust TLS Server Certificates Anchored by Symantec Root CAs The JDK will stop trusting TLS Server certificates issued by Symantec, in line with similar plans recently announced by Google, Mozilla, Apple, and Microsoft. The list of affected certificates includes certificates branded as GeoTrust, Thawte, and VeriSign, which were managed by Symantec. TLS Server certificates issued on or before April 16, 2019 will continue to be trusted until they expire. Certificates issued after that date will be rejected. See the [DigiCert support page](https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/) for information on how to replace your Symantec certificates with a DigiCert certificate (DigiCert took over validation and issuance for all Symantec Website Security SSL/TLS certificates on December 1, 2017). An exception to this policy is that TLS Server certificates issued through two subordinate Certificate Authorities managed by Apple, and identified below, will continue to be trusted as long as they are issued on or before December 31, 2019. The restrictions are enforced in the JDK implementation (the `SunJSSE` Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below. An application will receive an Exception with a message indicating the trust anchor is not trusted, ex: "TLS Server certificate issued after 2019-04-16 and anchored by a distrusted legacy Symantec root CA: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US" If necessary, and at your own risk, you can work around the restrictions by removing "SYMANTEC_TLS" from the `jdk.security.caDistrustPolicies` security property in the `java.security` configuration file. The restrictions are imposed on the following Symantec Root certificates included in the JDK:
Root Certificates distrusted after 2019-04-16
Distinguished Name SHA-256 Fingerprint
CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A
CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US

37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C
CN=GeoTrust Primary Certification Authority - G2, OU=(c) 2007 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66
CN=GeoTrust Primary Certification Authority - G3, OU=(c) 2008 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4
CN=GeoTrust Universal CA, O=GeoTrust Inc., C=US

A0:45:9B:9F:63:B2:25:59:F5:FA:5D:4C:6D:B3:F9:F7:2F:F1:93:42:03:35:78:F0:73:BF:1D:1B:46:CB:B9:12
CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F
CN=thawte Primary Root CA - G2, OU="(c) 2007 thawte, Inc. - For authorized use only", O="thawte, Inc.", C=US

A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57
CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C
EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

3F:9F:27:D5:83:20:4B:9E:09:C8:A3:D2:06:6C:4B:57:D3:A2:47:9C:36:93:65:08:80:50:56:98:10:5D:BC:E9
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

3A:43:E2:20:FE:7F:3E:A9:65:3D:1E:21:74:2E:AC:2B:75:C2:0F:D8:98:03:05:BC:50:2C:AF:8C:2D:9B:41:A1
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

A4:B6:B3:99:6F:C2:F3:06:B3:FD:86:81:BD:63:41:3D:8C:50:09:CC:4F:A3:29:C2:CC:F0:E2:FA:1B:14:03:05
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

83:CE:3C:12:29:68:8A:59:3D:48:5F:81:97:3C:0F:91:95:43:1E:DA:37:CC:5E:36:43:0E:79:C7:A8:88:63:8B
CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44
CN=VeriSign Class 3 Public Primary Certification Authority - G4, OU="(c) 2007 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF
CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C
Subordinate Certificates distrusted after 2019-12-31
Distinguished Name SHA-256 Fingerprint
CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US

AC:2B:92:2E:CF:D5:E0:17:11:77:2F:EA:8E:D3:72:DE:9D:1E:22:45:FC:E3:F5:7A:9C:DB:EC:77:29:6A:42:4B
CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US

A4:FE:7C:7F:15:15:5F:3F:0A:EF:7A:AA:83:CF:6E:06:DE:B9:7C:A3:F9:09:DF:92:0A:C1:49:08:82:D4:88:ED
If you have a TLS Server certificate issued by one of the CAs above, you should have received a message from DigiCert with information about replacing that certificate, free of charge. You can also use the `keytool` utility from the JDK to print out details of the certificate chain, as follows: keytool -v -list -alias -keystore If any of the certificates in the chain are issued by one of the root CAs in the table above are listed in the output you will need to update the certificate or contact the organization that manages the server if not yours. JDK-8214482: Removed TLS v1 and v1.1 from SSLContext Required Algorithms The requirement that all SE implementations must support TLSv1 and TLSv1.1 has been removed from the `javax.net.ssl.SSLContext` API and the Java Security Standard Algorithm Names specification. JDK-8209658: Disabled All DES TLS Cipher Suites DES-based TLS cipher suites are considered obsolete and should no longer be used. DES-based cipher suites have been deactivated by default in the SunJSSE implementation by adding the "DES" identifier to the `jdk.tls.disabledAlgorithms` security property. These cipher suites can be reactivated by removing "DES" from the `jdk.tls.disabledAlgorithms` security property in the `java.security` file or by dynamically calling the `Security.setProperty()` method. In both cases re-enabling DES must be followed by adding DES-based cipher suites to the enabled cipher suite list using the `SSLSocket.setEnabledCipherSuites()` or `SSLEngine.setEnabledCipherSuites()` methods. Note that prior to this change, DES40_CBC (but not all DES) suites were disabled via the `jdk.tls.disabledAlgorithms` security property. JDK-8210070: supported_groups Extension Should Not be Present in ServerHello Handshake Message While the `supported_groups` extension should not be present in ServerHello handshake messages, previous releases have ignored its presence, so that misconfigured servers could continue to function. JDK 11 currently throws an exception if this extension is sent in the ServerHello handshake message. JDK-8240229: Default SSL Session Cache Size Updated to 20480 The default SSL session cache size has been updated to 20480 in this JDK release JDK-8212998: Disabled TLS anon and NULL Cipher Suites The TLS anon (anonymous) and NULL cipher suites have been added to the `jdk.tls.disabledAlgorithms` security property and are now disabled by default. JDK-8210799: ChaCha20 and Poly1305 TLS Cipher Suites New TLS cipher suites using the `ChaCha20-Poly1305` algorithm have been added to JSSE. These cipher suites are enabled by default. The TLS_CHACHA20_POLY1305_SHA256 cipher suite is available for TLS 1.3. The following cipher suites are available for TLS 1.2: - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Refer to the "Java Secure Socket Extension (JSSE) Reference Guide" for details on these new TLS cipher suites. JDK-8215012: Distrust TLS Server Certificates Anchored by Symantec Root CAs The JDK will stop trusting TLS Server certificates issued by Symantec, in line with similar plans recently announced by Google, Mozilla, Apple, and Microsoft. The list of affected certificates includes certificates branded as GeoTrust, Thawte, and VeriSign, which were managed by Symantec. TLS Server certificates issued on or before April 16, 2019 will continue to be trusted until they expire. Certificates issued after that date will be rejected. See the [DigiCert support page](https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/) for information on how to replace your Symantec certificates with a DigiCert certificate (DigiCert took over validation and issuance for all Symantec Website Security SSL/TLS certificates on December 1, 2017). An exception to this policy is that TLS Server certificates issued through two subordinate Certificate Authorities managed by Apple, and identified below, will continue to be trusted as long as they are issued on or before December 31, 2019. The restrictions are enforced in the JDK implementation (the `SunJSSE` Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below. An application will receive an Exception with a message indicating the trust anchor is not trusted, ex: "TLS Server certificate issued after 2019-04-16 and anchored by a distrusted legacy Symantec root CA: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US" If necessary, and at your own risk, you can work around the restrictions by removing "SYMANTEC_TLS" from the `jdk.security.caDistrustPolicies` security property in the `java.security` configuration file. The restrictions are imposed on the following Symantec Root certificates included in the JDK:
Root Certificates distrusted after 2019-04-16
Distinguished Name SHA-256 Fingerprint
CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A
CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US

37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C
CN=GeoTrust Primary Certification Authority - G2, OU=(c) 2007 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66
CN=GeoTrust Primary Certification Authority - G3, OU=(c) 2008 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4
CN=GeoTrust Universal CA, O=GeoTrust Inc., C=US

A0:45:9B:9F:63:B2:25:59:F5:FA:5D:4C:6D:B3:F9:F7:2F:F1:93:42:03:35:78:F0:73:BF:1D:1B:46:CB:B9:12
CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F
CN=thawte Primary Root CA - G2, OU="(c) 2007 thawte, Inc. - For authorized use only", O="thawte, Inc.", C=US

A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57
CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C
EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

3F:9F:27:D5:83:20:4B:9E:09:C8:A3:D2:06:6C:4B:57:D3:A2:47:9C:36:93:65:08:80:50:56:98:10:5D:BC:E9
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

3A:43:E2:20:FE:7F:3E:A9:65:3D:1E:21:74:2E:AC:2B:75:C2:0F:D8:98:03:05:BC:50:2C:AF:8C:2D:9B:41:A1
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

A4:B6:B3:99:6F:C2:F3:06:B3:FD:86:81:BD:63:41:3D:8C:50:09:CC:4F:A3:29:C2:CC:F0:E2:FA:1B:14:03:05
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

83:CE:3C:12:29:68:8A:59:3D:48:5F:81:97:3C:0F:91:95:43:1E:DA:37:CC:5E:36:43:0E:79:C7:A8:88:63:8B
CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44
CN=VeriSign Class 3 Public Primary Certification Authority - G4, OU="(c) 2007 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF
CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C
Subordinate Certificates distrusted after 2019-12-31
Distinguished Name SHA-256 Fingerprint
CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US

AC:2B:92:2E:CF:D5:E0:17:11:77:2F:EA:8E:D3:72:DE:9D:1E:22:45:FC:E3:F5:7A:9C:DB:EC:77:29:6A:42:4B
CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US

A4:FE:7C:7F:15:15:5F:3F:0A:EF:7A:AA:83:CF:6E:06:DE:B9:7C:A3:F9:09:DF:92:0A:C1:49:08:82:D4:88:ED
If you have a TLS Server certificate issued by one of the CAs above, you should have received a message from DigiCert with information about replacing that certificate, free of charge. You can also use the `keytool` utility from the JDK to print out details of the certificate chain, as follows: keytool -v -list -alias -keystore If any of the certificates in the chain are issued by one of the root CAs in the table above are listed in the output you will need to update the certificate or contact the organization that manages the server if not yours. JDK-8214482: Removed TLS v1 and v1.1 from SSLContext Required Algorithms The requirement that all SE implementations must support TLSv1 and TLSv1.1 has been removed from the `javax.net.ssl.SSLContext` API and the Java Security Standard Algorithm Names specification. JDK-8209658: Disabled All DES TLS Cipher Suites DES-based TLS cipher suites are considered obsolete and should no longer be used. DES-based cipher suites have been deactivated by default in the SunJSSE implementation by adding the "DES" identifier to the `jdk.tls.disabledAlgorithms` security property. These cipher suites can be reactivated by removing "DES" from the `jdk.tls.disabledAlgorithms` security property in the `java.security` file or by dynamically calling the `Security.setProperty()` method. In both cases re-enabling DES must be followed by adding DES-based cipher suites to the enabled cipher suite list using the `SSLSocket.setEnabledCipherSuites()` or `SSLEngine.setEnabledCipherSuites()` methods. Note that prior to this change, DES40_CBC (but not all DES) suites were disabled via the `jdk.tls.disabledAlgorithms` security property. JDK-8210070: supported_groups Extension Should Not be Present in ServerHello Handshake Message While the `supported_groups` extension should not be present in ServerHello handshake messages, previous releases have ignored its presence, so that misconfigured servers could continue to function. JDK 11 currently throws an exception if this extension is sent in the ServerHello handshake message. JDK-8240229: Default SSL Session Cache Size Updated to 20480 The default SSL session cache size has been updated to 20480 in this JDK release JDK-8212998: Disabled TLS anon and NULL Cipher Suites The TLS anon (anonymous) and NULL cipher suites have been added to the `jdk.tls.disabledAlgorithms` security property and are now disabled by default. JDK-8210799: ChaCha20 and Poly1305 TLS Cipher Suites New TLS cipher suites using the `ChaCha20-Poly1305` algorithm have been added to JSSE. These cipher suites are enabled by default. The TLS_CHACHA20_POLY1305_SHA256 cipher suite is available for TLS 1.3. The following cipher suites are available for TLS 1.2: - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Refer to the "Java Secure Socket Extension (JSSE) Reference Guide" for details on these new TLS cipher suites. JDK-8215012: Distrust TLS Server Certificates Anchored by Symantec Root CAs The JDK will stop trusting TLS Server certificates issued by Symantec, in line with similar plans recently announced by Google, Mozilla, Apple, and Microsoft. The list of affected certificates includes certificates branded as GeoTrust, Thawte, and VeriSign, which were managed by Symantec. TLS Server certificates issued on or before April 16, 2019 will continue to be trusted until they expire. Certificates issued after that date will be rejected. See the [DigiCert support page](https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/) for information on how to replace your Symantec certificates with a DigiCert certificate (DigiCert took over validation and issuance for all Symantec Website Security SSL/TLS certificates on December 1, 2017). An exception to this policy is that TLS Server certificates issued through two subordinate Certificate Authorities managed by Apple, and identified below, will continue to be trusted as long as they are issued on or before December 31, 2019. The restrictions are enforced in the JDK implementation (the `SunJSSE` Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below. An application will receive an Exception with a message indicating the trust anchor is not trusted, ex: "TLS Server certificate issued after 2019-04-16 and anchored by a distrusted legacy Symantec root CA: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US" If necessary, and at your own risk, you can work around the restrictions by removing "SYMANTEC_TLS" from the `jdk.security.caDistrustPolicies` security property in the `java.security` configuration file. The restrictions are imposed on the following Symantec Root certificates included in the JDK:
Root Certificates distrusted after 2019-04-16
Distinguished Name SHA-256 Fingerprint
CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A
CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US

37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C
CN=GeoTrust Primary Certification Authority - G2, OU=(c) 2007 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66
CN=GeoTrust Primary Certification Authority - G3, OU=(c) 2008 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4
CN=GeoTrust Universal CA, O=GeoTrust Inc., C=US

A0:45:9B:9F:63:B2:25:59:F5:FA:5D:4C:6D:B3:F9:F7:2F:F1:93:42:03:35:78:F0:73:BF:1D:1B:46:CB:B9:12
CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F
CN=thawte Primary Root CA - G2, OU="(c) 2007 thawte, Inc. - For authorized use only", O="thawte, Inc.", C=US

A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57
CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C
EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

3F:9F:27:D5:83:20:4B:9E:09:C8:A3:D2:06:6C:4B:57:D3:A2:47:9C:36:93:65:08:80:50:56:98:10:5D:BC:E9
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

3A:43:E2:20:FE:7F:3E:A9:65:3D:1E:21:74:2E:AC:2B:75:C2:0F:D8:98:03:05:BC:50:2C:AF:8C:2D:9B:41:A1
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

A4:B6:B3:99:6F:C2:F3:06:B3:FD:86:81:BD:63:41:3D:8C:50:09:CC:4F:A3:29:C2:CC:F0:E2:FA:1B:14:03:05
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

83:CE:3C:12:29:68:8A:59:3D:48:5F:81:97:3C:0F:91:95:43:1E:DA:37:CC:5E:36:43:0E:79:C7:A8:88:63:8B
CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44
CN=VeriSign Class 3 Public Primary Certification Authority - G4, OU="(c) 2007 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF
CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C
Subordinate Certificates distrusted after 2019-12-31
Distinguished Name SHA-256 Fingerprint
CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US

AC:2B:92:2E:CF:D5:E0:17:11:77:2F:EA:8E:D3:72:DE:9D:1E:22:45:FC:E3:F5:7A:9C:DB:EC:77:29:6A:42:4B
CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US

A4:FE:7C:7F:15:15:5F:3F:0A:EF:7A:AA:83:CF:6E:06:DE:B9:7C:A3:F9:09:DF:92:0A:C1:49:08:82:D4:88:ED
If you have a TLS Server certificate issued by one of the CAs above, you should have received a message from DigiCert with information about replacing that certificate, free of charge. You can also use the `keytool` utility from the JDK to print out details of the certificate chain, as follows: keytool -v -list -alias -keystore If any of the certificates in the chain are issued by one of the root CAs in the table above are listed in the output you will need to update the certificate or contact the organization that manages the server if not yours. JDK-8214482: Removed TLS v1 and v1.1 from SSLContext Required Algorithms The requirement that all SE implementations must support TLSv1 and TLSv1.1 has been removed from the `javax.net.ssl.SSLContext` API and the Java Security Standard Algorithm Names specification. JDK-8209658: Disabled All DES TLS Cipher Suites DES-based TLS cipher suites are considered obsolete and should no longer be used. DES-based cipher suites have been deactivated by default in the SunJSSE implementation by adding the "DES" identifier to the `jdk.tls.disabledAlgorithms` security property. These cipher suites can be reactivated by removing "DES" from the `jdk.tls.disabledAlgorithms` security property in the `java.security` file or by dynamically calling the `Security.setProperty()` method. In both cases re-enabling DES must be followed by adding DES-based cipher suites to the enabled cipher suite list using the `SSLSocket.setEnabledCipherSuites()` or `SSLEngine.setEnabledCipherSuites()` methods. Note that prior to this change, DES40_CBC (but not all DES) suites were disabled via the `jdk.tls.disabledAlgorithms` security property. JDK-8210070: supported_groups Extension Should Not be Present in ServerHello Handshake Message While the `supported_groups` extension should not be present in ServerHello handshake messages, previous releases have ignored its presence, so that misconfigured servers could continue to function. JDK 11 currently throws an exception if this extension is sent in the ServerHello handshake message. JDK-8240229: Default SSL Session Cache Size Updated to 20480 The default SSL session cache size has been updated to 20480 in this JDK release JDK-8212998: Disabled TLS anon and NULL Cipher Suites The TLS anon (anonymous) and NULL cipher suites have been added to the `jdk.tls.disabledAlgorithms` security property and are now disabled by default. JDK-8210799: ChaCha20 and Poly1305 TLS Cipher Suites New TLS cipher suites using the `ChaCha20-Poly1305` algorithm have been added to JSSE. These cipher suites are enabled by default. The TLS_CHACHA20_POLY1305_SHA256 cipher suite is available for TLS 1.3. The following cipher suites are available for TLS 1.2: - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Refer to the "Java Secure Socket Extension (JSSE) Reference Guide" for details on these new TLS cipher suites. JDK-8215012: Distrust TLS Server Certificates Anchored by Symantec Root CAs The JDK will stop trusting TLS Server certificates issued by Symantec, in line with similar plans recently announced by Google, Mozilla, Apple, and Microsoft. The list of affected certificates includes certificates branded as GeoTrust, Thawte, and VeriSign, which were managed by Symantec. TLS Server certificates issued on or before April 16, 2019 will continue to be trusted until they expire. Certificates issued after that date will be rejected. See the [DigiCert support page](https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/) for information on how to replace your Symantec certificates with a DigiCert certificate (DigiCert took over validation and issuance for all Symantec Website Security SSL/TLS certificates on December 1, 2017). An exception to this policy is that TLS Server certificates issued through two subordinate Certificate Authorities managed by Apple, and identified below, will continue to be trusted as long as they are issued on or before December 31, 2019. The restrictions are enforced in the JDK implementation (the `SunJSSE` Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below. An application will receive an Exception with a message indicating the trust anchor is not trusted, ex: "TLS Server certificate issued after 2019-04-16 and anchored by a distrusted legacy Symantec root CA: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US" If necessary, and at your own risk, you can work around the restrictions by removing "SYMANTEC_TLS" from the `jdk.security.caDistrustPolicies` security property in the `java.security` configuration file. The restrictions are imposed on the following Symantec Root certificates included in the JDK:
Root Certificates distrusted after 2019-04-16
Distinguished Name SHA-256 Fingerprint
CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A
CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US

37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C
CN=GeoTrust Primary Certification Authority - G2, OU=(c) 2007 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66
CN=GeoTrust Primary Certification Authority - G3, OU=(c) 2008 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4
CN=GeoTrust Universal CA, O=GeoTrust Inc., C=US

A0:45:9B:9F:63:B2:25:59:F5:FA:5D:4C:6D:B3:F9:F7:2F:F1:93:42:03:35:78:F0:73:BF:1D:1B:46:CB:B9:12
CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F
CN=thawte Primary Root CA - G2, OU="(c) 2007 thawte, Inc. - For authorized use only", O="thawte, Inc.", C=US

A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57
CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C
EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

3F:9F:27:D5:83:20:4B:9E:09:C8:A3:D2:06:6C:4B:57:D3:A2:47:9C:36:93:65:08:80:50:56:98:10:5D:BC:E9
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

3A:43:E2:20:FE:7F:3E:A9:65:3D:1E:21:74:2E:AC:2B:75:C2:0F:D8:98:03:05:BC:50:2C:AF:8C:2D:9B:41:A1
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

A4:B6:B3:99:6F:C2:F3:06:B3:FD:86:81:BD:63:41:3D:8C:50:09:CC:4F:A3:29:C2:CC:F0:E2:FA:1B:14:03:05
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

83:CE:3C:12:29:68:8A:59:3D:48:5F:81:97:3C:0F:91:95:43:1E:DA:37:CC:5E:36:43:0E:79:C7:A8:88:63:8B
CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44
CN=VeriSign Class 3 Public Primary Certification Authority - G4, OU="(c) 2007 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF
CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C
Subordinate Certificates distrusted after 2019-12-31
Distinguished Name SHA-256 Fingerprint
CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US

AC:2B:92:2E:CF:D5:E0:17:11:77:2F:EA:8E:D3:72:DE:9D:1E:22:45:FC:E3:F5:7A:9C:DB:EC:77:29:6A:42:4B
CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US

A4:FE:7C:7F:15:15:5F:3F:0A:EF:7A:AA:83:CF:6E:06:DE:B9:7C:A3:F9:09:DF:92:0A:C1:49:08:82:D4:88:ED
If you have a TLS Server certificate issued by one of the CAs above, you should have received a message from DigiCert with information about replacing that certificate, free of charge. You can also use the `keytool` utility from the JDK to print out details of the certificate chain, as follows: keytool -v -list -alias -keystore If any of the certificates in the chain are issued by one of the root CAs in the table above are listed in the output you will need to update the certificate or contact the organization that manages the server if not yours. JDK-8214482: Removed TLS v1 and v1.1 from SSLContext Required Algorithms The requirement that all SE implementations must support TLSv1 and TLSv1.1 has been removed from the `javax.net.ssl.SSLContext` API and the Java Security Standard Algorithm Names specification. JDK-8209658: Disabled All DES TLS Cipher Suites DES-based TLS cipher suites are considered obsolete and should no longer be used. DES-based cipher suites have been deactivated by default in the SunJSSE implementation by adding the "DES" identifier to the `jdk.tls.disabledAlgorithms` security property. These cipher suites can be reactivated by removing "DES" from the `jdk.tls.disabledAlgorithms` security property in the `java.security` file or by dynamically calling the `Security.setProperty()` method. In both cases re-enabling DES must be followed by adding DES-based cipher suites to the enabled cipher suite list using the `SSLSocket.setEnabledCipherSuites()` or `SSLEngine.setEnabledCipherSuites()` methods. Note that prior to this change, DES40_CBC (but not all DES) suites were disabled via the `jdk.tls.disabledAlgorithms` security property. JDK-8210070: supported_groups Extension Should Not be Present in ServerHello Handshake Message While the `supported_groups` extension should not be present in ServerHello handshake messages, previous releases have ignored its presence, so that misconfigured servers could continue to function. JDK 11 currently throws an exception if this extension is sent in the ServerHello handshake message. JDK-8240229: Default SSL Session Cache Size Updated to 20480 The default SSL session cache size has been updated to 20480 in this JDK release JDK-8212998: Disabled TLS anon and NULL Cipher Suites The TLS anon (anonymous) and NULL cipher suites have been added to the `jdk.tls.disabledAlgorithms` security property and are now disabled by default. JDK-8210799: ChaCha20 and Poly1305 TLS Cipher Suites New TLS cipher suites using the `ChaCha20-Poly1305` algorithm have been added to JSSE. These cipher suites are enabled by default. The TLS_CHACHA20_POLY1305_SHA256 cipher suite is available for TLS 1.3. The following cipher suites are available for TLS 1.2: - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Refer to the "Java Secure Socket Extension (JSSE) Reference Guide" for details on these new TLS cipher suites. JDK-8215012: Distrust TLS Server Certificates Anchored by Symantec Root CAs The JDK will stop trusting TLS Server certificates issued by Symantec, in line with similar plans recently announced by Google, Mozilla, Apple, and Microsoft. The list of affected certificates includes certificates branded as GeoTrust, Thawte, and VeriSign, which were managed by Symantec. TLS Server certificates issued on or before April 16, 2019 will continue to be trusted until they expire. Certificates issued after that date will be rejected. See the [DigiCert support page](https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/) for information on how to replace your Symantec certificates with a DigiCert certificate (DigiCert took over validation and issuance for all Symantec Website Security SSL/TLS certificates on December 1, 2017). An exception to this policy is that TLS Server certificates issued through two subordinate Certificate Authorities managed by Apple, and identified below, will continue to be trusted as long as they are issued on or before December 31, 2019. The restrictions are enforced in the JDK implementation (the `SunJSSE` Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below. An application will receive an Exception with a message indicating the trust anchor is not trusted, ex: "TLS Server certificate issued after 2019-04-16 and anchored by a distrusted legacy Symantec root CA: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US" If necessary, and at your own risk, you can work around the restrictions by removing "SYMANTEC_TLS" from the `jdk.security.caDistrustPolicies` security property in the `java.security` configuration file. The restrictions are imposed on the following Symantec Root certificates included in the JDK:
Root Certificates distrusted after 2019-04-16
Distinguished Name SHA-256 Fingerprint
CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A
CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US

37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C
CN=GeoTrust Primary Certification Authority - G2, OU=(c) 2007 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66
CN=GeoTrust Primary Certification Authority - G3, OU=(c) 2008 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4
CN=GeoTrust Universal CA, O=GeoTrust Inc., C=US

A0:45:9B:9F:63:B2:25:59:F5:FA:5D:4C:6D:B3:F9:F7:2F:F1:93:42:03:35:78:F0:73:BF:1D:1B:46:CB:B9:12
CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F
CN=thawte Primary Root CA - G2, OU="(c) 2007 thawte, Inc. - For authorized use only", O="thawte, Inc.", C=US

A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57
CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C
EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

3F:9F:27:D5:83:20:4B:9E:09:C8:A3:D2:06:6C:4B:57:D3:A2:47:9C:36:93:65:08:80:50:56:98:10:5D:BC:E9
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

3A:43:E2:20:FE:7F:3E:A9:65:3D:1E:21:74:2E:AC:2B:75:C2:0F:D8:98:03:05:BC:50:2C:AF:8C:2D:9B:41:A1
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

A4:B6:B3:99:6F:C2:F3:06:B3:FD:86:81:BD:63:41:3D:8C:50:09:CC:4F:A3:29:C2:CC:F0:E2:FA:1B:14:03:05
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

83:CE:3C:12:29:68:8A:59:3D:48:5F:81:97:3C:0F:91:95:43:1E:DA:37:CC:5E:36:43:0E:79:C7:A8:88:63:8B
CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44
CN=VeriSign Class 3 Public Primary Certification Authority - G4, OU="(c) 2007 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF
CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C
Subordinate Certificates distrusted after 2019-12-31
Distinguished Name SHA-256 Fingerprint
CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US

AC:2B:92:2E:CF:D5:E0:17:11:77:2F:EA:8E:D3:72:DE:9D:1E:22:45:FC:E3:F5:7A:9C:DB:EC:77:29:6A:42:4B
CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US

A4:FE:7C:7F:15:15:5F:3F:0A:EF:7A:AA:83:CF:6E:06:DE:B9:7C:A3:F9:09:DF:92:0A:C1:49:08:82:D4:88:ED
If you have a TLS Server certificate issued by one of the CAs above, you should have received a message from DigiCert with information about replacing that certificate, free of charge. You can also use the `keytool` utility from the JDK to print out details of the certificate chain, as follows: keytool -v -list -alias -keystore If any of the certificates in the chain are issued by one of the root CAs in the table above are listed in the output you will need to update the certificate or contact the organization that manages the server if not yours. JDK-8214482: Removed TLS v1 and v1.1 from SSLContext Required Algorithms The requirement that all SE implementations must support TLSv1 and TLSv1.1 has been removed from the `javax.net.ssl.SSLContext` API and the Java Security Standard Algorithm Names specification. JDK-8209658: Disabled All DES TLS Cipher Suites DES-based TLS cipher suites are considered obsolete and should no longer be used. DES-based cipher suites have been deactivated by default in the SunJSSE implementation by adding the "DES" identifier to the `jdk.tls.disabledAlgorithms` security property. These cipher suites can be reactivated by removing "DES" from the `jdk.tls.disabledAlgorithms` security property in the `java.security` file or by dynamically calling the `Security.setProperty()` method. In both cases re-enabling DES must be followed by adding DES-based cipher suites to the enabled cipher suite list using the `SSLSocket.setEnabledCipherSuites()` or `SSLEngine.setEnabledCipherSuites()` methods. Note that prior to this change, DES40_CBC (but not all DES) suites were disabled via the `jdk.tls.disabledAlgorithms` security property. JDK-8210070: supported_groups Extension Should Not be Present in ServerHello Handshake Message While the `supported_groups` extension should not be present in ServerHello handshake messages, previous releases have ignored its presence, so that misconfigured servers could continue to function. JDK 11 currently throws an exception if this extension is sent in the ServerHello handshake message. JDK-8240229: Default SSL Session Cache Size Updated to 20480 The default SSL session cache size has been updated to 20480 in this JDK release JDK-8212998: Disabled TLS anon and NULL Cipher Suites The TLS anon (anonymous) and NULL cipher suites have been added to the `jdk.tls.disabledAlgorithms` security property and are now disabled by default. JDK-8210799: ChaCha20 and Poly1305 TLS Cipher Suites New TLS cipher suites using the `ChaCha20-Poly1305` algorithm have been added to JSSE. These cipher suites are enabled by default. The TLS_CHACHA20_POLY1305_SHA256 cipher suite is available for TLS 1.3. The following cipher suites are available for TLS 1.2: - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Refer to the "Java Secure Socket Extension (JSSE) Reference Guide" for details on these new TLS cipher suites. JDK-8215012: Distrust TLS Server Certificates Anchored by Symantec Root CAs The JDK will stop trusting TLS Server certificates issued by Symantec, in line with similar plans recently announced by Google, Mozilla, Apple, and Microsoft. The list of affected certificates includes certificates branded as GeoTrust, Thawte, and VeriSign, which were managed by Symantec. TLS Server certificates issued on or before April 16, 2019 will continue to be trusted until they expire. Certificates issued after that date will be rejected. See the [DigiCert support page](https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/) for information on how to replace your Symantec certificates with a DigiCert certificate (DigiCert took over validation and issuance for all Symantec Website Security SSL/TLS certificates on December 1, 2017). An exception to this policy is that TLS Server certificates issued through two subordinate Certificate Authorities managed by Apple, and identified below, will continue to be trusted as long as they are issued on or before December 31, 2019. The restrictions are enforced in the JDK implementation (the `SunJSSE` Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below. An application will receive an Exception with a message indicating the trust anchor is not trusted, ex: "TLS Server certificate issued after 2019-04-16 and anchored by a distrusted legacy Symantec root CA: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US" If necessary, and at your own risk, you can work around the restrictions by removing "SYMANTEC_TLS" from the `jdk.security.caDistrustPolicies` security property in the `java.security` configuration file. The restrictions are imposed on the following Symantec Root certificates included in the JDK:
Root Certificates distrusted after 2019-04-16
Distinguished Name SHA-256 Fingerprint
CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A
CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US

37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C
CN=GeoTrust Primary Certification Authority - G2, OU=(c) 2007 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66
CN=GeoTrust Primary Certification Authority - G3, OU=(c) 2008 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4
CN=GeoTrust Universal CA, O=GeoTrust Inc., C=US

A0:45:9B:9F:63:B2:25:59:F5:FA:5D:4C:6D:B3:F9:F7:2F:F1:93:42:03:35:78:F0:73:BF:1D:1B:46:CB:B9:12
CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F
CN=thawte Primary Root CA - G2, OU="(c) 2007 thawte, Inc. - For authorized use only", O="thawte, Inc.", C=US

A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57
CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C
EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

3F:9F:27:D5:83:20:4B:9E:09:C8:A3:D2:06:6C:4B:57:D3:A2:47:9C:36:93:65:08:80:50:56:98:10:5D:BC:E9
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

3A:43:E2:20:FE:7F:3E:A9:65:3D:1E:21:74:2E:AC:2B:75:C2:0F:D8:98:03:05:BC:50:2C:AF:8C:2D:9B:41:A1
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

A4:B6:B3:99:6F:C2:F3:06:B3:FD:86:81:BD:63:41:3D:8C:50:09:CC:4F:A3:29:C2:CC:F0:E2:FA:1B:14:03:05
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

83:CE:3C:12:29:68:8A:59:3D:48:5F:81:97:3C:0F:91:95:43:1E:DA:37:CC:5E:36:43:0E:79:C7:A8:88:63:8B
CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44
CN=VeriSign Class 3 Public Primary Certification Authority - G4, OU="(c) 2007 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF
CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C
Subordinate Certificates distrusted after 2019-12-31
Distinguished Name SHA-256 Fingerprint
CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US

AC:2B:92:2E:CF:D5:E0:17:11:77:2F:EA:8E:D3:72:DE:9D:1E:22:45:FC:E3:F5:7A:9C:DB:EC:77:29:6A:42:4B
CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US

A4:FE:7C:7F:15:15:5F:3F:0A:EF:7A:AA:83:CF:6E:06:DE:B9:7C:A3:F9:09:DF:92:0A:C1:49:08:82:D4:88:ED
If you have a TLS Server certificate issued by one of the CAs above, you should have received a message from DigiCert with information about replacing that certificate, free of charge. You can also use the `keytool` utility from the JDK to print out details of the certificate chain, as follows: keytool -v -list -alias -keystore If any of the certificates in the chain are issued by one of the root CAs in the table above are listed in the output you will need to update the certificate or contact the organization that manages the server if not yours. JDK-8214482: Removed TLS v1 and v1.1 from SSLContext Required Algorithms The requirement that all SE implementations must support TLSv1 and TLSv1.1 has been removed from the `javax.net.ssl.SSLContext` API and the Java Security Standard Algorithm Names specification. JDK-8209658: Disabled All DES TLS Cipher Suites DES-based TLS cipher suites are considered obsolete and should no longer be used. DES-based cipher suites have been deactivated by default in the SunJSSE implementation by adding the "DES" identifier to the `jdk.tls.disabledAlgorithms` security property. These cipher suites can be reactivated by removing "DES" from the `jdk.tls.disabledAlgorithms` security property in the `java.security` file or by dynamically calling the `Security.setProperty()` method. In both cases re-enabling DES must be followed by adding DES-based cipher suites to the enabled cipher suite list using the `SSLSocket.setEnabledCipherSuites()` or `SSLEngine.setEnabledCipherSuites()` methods. Note that prior to this change, DES40_CBC (but not all DES) suites were disabled via the `jdk.tls.disabledAlgorithms` security property. JDK-8210070: supported_groups Extension Should Not be Present in ServerHello Handshake Message While the `supported_groups` extension should not be present in ServerHello handshake messages, previous releases have ignored its presence, so that misconfigured servers could continue to function. JDK 11 currently throws an exception if this extension is sent in the ServerHello handshake message. JDK-8240229: Default SSL Session Cache Size Updated to 20480 The default SSL session cache size has been updated to 20480 in this JDK release JDK-8212998: Disabled TLS anon and NULL Cipher Suites The TLS anon (anonymous) and NULL cipher suites have been added to the `jdk.tls.disabledAlgorithms` security property and are now disabled by default. JDK-8210799: ChaCha20 and Poly1305 TLS Cipher Suites New TLS cipher suites using the `ChaCha20-Poly1305` algorithm have been added to JSSE. These cipher suites are enabled by default. The TLS_CHACHA20_POLY1305_SHA256 cipher suite is available for TLS 1.3. The following cipher suites are available for TLS 1.2: - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Refer to the "Java Secure Socket Extension (JSSE) Reference Guide" for details on these new TLS cipher suites. JDK-8215012: Distrust TLS Server Certificates Anchored by Symantec Root CAs The JDK will stop trusting TLS Server certificates issued by Symantec, in line with similar plans recently announced by Google, Mozilla, Apple, and Microsoft. The list of affected certificates includes certificates branded as GeoTrust, Thawte, and VeriSign, which were managed by Symantec. TLS Server certificates issued on or before April 16, 2019 will continue to be trusted until they expire. Certificates issued after that date will be rejected. See the [DigiCert support page](https://www.digicert.com/replace-your-symantec-ssl-tls-certificates/) for information on how to replace your Symantec certificates with a DigiCert certificate (DigiCert took over validation and issuance for all Symantec Website Security SSL/TLS certificates on December 1, 2017). An exception to this policy is that TLS Server certificates issued through two subordinate Certificate Authorities managed by Apple, and identified below, will continue to be trusted as long as they are issued on or before December 31, 2019. The restrictions are enforced in the JDK implementation (the `SunJSSE` Provider) of the Java Secure Socket Extension (JSSE) API. A TLS session will not be negotiated if the server's certificate chain is anchored by any of the Certificate Authorities in the table below. An application will receive an Exception with a message indicating the trust anchor is not trusted, ex: "TLS Server certificate issued after 2019-04-16 and anchored by a distrusted legacy Symantec root CA: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US" If necessary, and at your own risk, you can work around the restrictions by removing "SYMANTEC_TLS" from the `jdk.security.caDistrustPolicies` security property in the `java.security` configuration file. The restrictions are imposed on the following Symantec Root certificates included in the JDK:
Root Certificates distrusted after 2019-04-16
Distinguished Name SHA-256 Fingerprint
CN=GeoTrust Global CA, O=GeoTrust Inc., C=US

FF:85:6A:2D:25:1D:CD:88:D3:66:56:F4:50:12:67:98:CF:AB:AA:DE:40:79:9C:72:2D:E4:D2:B5:DB:36:A7:3A
CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US

37:D5:10:06:C5:12:EA:AB:62:64:21:F1:EC:8C:92:01:3F:C5:F8:2A:E9:8E:E5:33:EB:46:19:B8:DE:B4:D0:6C
CN=GeoTrust Primary Certification Authority - G2, OU=(c) 2007 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

5E:DB:7A:C4:3B:82:A0:6A:87:61:E8:D7:BE:49:79:EB:F2:61:1F:7D:D7:9B:F9:1C:1C:6B:56:6A:21:9E:D7:66
CN=GeoTrust Primary Certification Authority - G3, OU=(c) 2008 GeoTrust Inc. - For authorized use only, O=GeoTrust Inc., C=US

B4:78:B8:12:25:0D:F8:78:63:5C:2A:A7:EC:7D:15:5E:AA:62:5E:E8:29:16:E2:CD:29:43:61:88:6C:D1:FB:D4
CN=GeoTrust Universal CA, O=GeoTrust Inc., C=US

A0:45:9B:9F:63:B2:25:59:F5:FA:5D:4C:6D:B3:F9:F7:2F:F1:93:42:03:35:78:F0:73:BF:1D:1B:46:CB:B9:12
CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

8D:72:2F:81:A9:C1:13:C0:79:1D:F1:36:A2:96:6D:B2:6C:95:0A:97:1D:B4:6B:41:99:F4:EA:54:B7:8B:FB:9F
CN=thawte Primary Root CA - G2, OU="(c) 2007 thawte, Inc. - For authorized use only", O="thawte, Inc.", C=US

A4:31:0D:50:AF:18:A6:44:71:90:37:2A:86:AF:AF:8B:95:1F:FB:43:1D:83:7F:1E:56:88:B4:59:71:ED:15:57
CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US

4B:03:F4:58:07:AD:70:F2:1B:FC:2C:AE:71:C9:FD:E4:60:4C:06:4C:F5:FF:B6:86:BA:E5:DB:AA:D7:FD:D3:4C
EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

3F:9F:27:D5:83:20:4B:9E:09:C8:A3:D2:06:6C:4B:57:D3:A2:47:9C:36:93:65:08:80:50:56:98:10:5D:BC:E9
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

3A:43:E2:20:FE:7F:3E:A9:65:3D:1E:21:74:2E:AC:2B:75:C2:0F:D8:98:03:05:BC:50:2C:AF:8C:2D:9B:41:A1
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

A4:B6:B3:99:6F:C2:F3:06:B3:FD:86:81:BD:63:41:3D:8C:50:09:CC:4F:A3:29:C2:CC:F0:E2:FA:1B:14:03:05
OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

83:CE:3C:12:29:68:8A:59:3D:48:5F:81:97:3C:0F:91:95:43:1E:DA:37:CC:5E:36:43:0E:79:C7:A8:88:63:8B
CN=VeriSign Class 3 Public Primary Certification Authority - G3, OU="(c) 1999 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

EB:04:CF:5E:B1:F3:9A:FA:76:2F:2B:B1:20:F2:96:CB:A5:20:C1:B9:7D:B1:58:95:65:B8:1C:B9:A1:7B:72:44
CN=VeriSign Class 3 Public Primary Certification Authority - G4, OU="(c) 2007 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

69:DD:D7:EA:90:BB:57:C9:3E:13:5D:C8:5E:A6:FC:D5:48:0B:60:32:39:BD:C4:54:FC:75:8B:2A:26:CF:7F:79
CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

9A:CF:AB:7E:43:C8:D8:80:D0:6B:26:2A:94:DE:EE:E4:B4:65:99:89:C3:D0:CA:F1:9B:AF:64:05:E4:1A:B7:DF
CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

23:99:56:11:27:A5:71:25:DE:8C:EF:EA:61:0D:DF:2F:A0:78:B5:C8:06:7F:4E:82:82:90:BF:B8:60:E8:4B:3C
Subordinate Certificates distrusted after 2019-12-31
Distinguished Name SHA-256 Fingerprint
CN=Apple IST CA 2 - G1, OU=Certification Authority, O=Apple Inc., C=US

AC:2B:92:2E:CF:D5:E0:17:11:77:2F:EA:8E:D3:72:DE:9D:1E:22:45:FC:E3:F5:7A:9C:DB:EC:77:29:6A:42:4B
CN=Apple IST CA 8 - G1, OU=Certification Authority, O=Apple Inc., C=US

A4:FE:7C:7F:15:15:5F:3F:0A:EF:7A:AA:83:CF:6E:06:DE:B9:7C:A3:F9:09:DF:92:0A:C1:49:08:82:D4:88:ED
If you have a TLS Server certificate issued by one of the CAs above, you should have received a message from DigiCert with information about replacing that certificate, free of charge. You can also use the `keytool` utility from the JDK to print out details of the certificate chain, as follows: keytool -v -list -alias -keystore If any of the certificates in the chain are issued by one of the root CAs in the table above are listed in the output you will need to update the certificate or contact the organization that manages the server if not yours. JDK-8214482: Removed TLS v1 and v1.1 from SSLContext Required Algorithms The requirement that all SE implementations must support TLSv1 and TLSv1.1 has been removed from the `javax.net.ssl.SSLContext` API and the Java Security Standard Algorithm Names specification. JDK-8209658: Disabled All DES TLS Cipher Suites DES-based TLS cipher suites are considered obsolete and should no longer be used. DES-based cipher suites have been deactivated by default in the SunJSSE implementation by adding the "DES" identifier to the `jdk.tls.disabledAlgorithms` security property. These cipher suites can be reactivated by removing "DES" from the `jdk.tls.disabledAlgorithms` security property in the `java.security` file or by dynamically calling the `Security.setProperty()` method. In both cases re-enabling DES must be followed by adding DES-based cipher suites to the enabled cipher suite list using the `SSLSocket.setEnabledCipherSuites()` or `SSLEngine.setEnabledCipherSuites()` methods. Note that prior to this change, DES40_CBC (but not all DES) suites were disabled via the `jdk.tls.disabledAlgorithms` security property. JDK-8210070: supported_groups Extension Should Not be Present in ServerHello Handshake Message While the `supported_groups` extension should not be present in ServerHello handshake messages, previous releases have ignored its presence, so that misconfigured servers could continue to function. JDK 11 currently throws an exception if this extension is sent in the ServerHello handshake message. JDK-8240229: Default SSL Session Cache Size Updated to 20480 The default SSL session cache size has been updated to 20480 in this JDK release JDK-8212998: Disabled TLS anon and NULL Cipher Suites The TLS anon (anonymous) and NULL cipher suites have been added to the `jdk.tls.disabledAlgorithms` security property and are now disabled by default. security-libs/javax.crypto: JDK-8213946: Change to X25519 and X448 Encoded Private Key Format The encoded format of X25519 and X448 private keys has been corrected to use the standard format described in RFC 8410. This change affects any private key produced from the "X25519", "X448", or "XDH" services in the SunEC provider. The correct format is not compatible with the format used in previous JDK versions. It is recommended that existing incompatible keys in storage be replaced with newly-generated private keys. core-libs/java.nio: JDK-8251329: (zipfs) Files.walkFileTree walks infinitely if zip has dir named "." inside A DESCRIPTION OF THE PROBLEM : There is an existing fixed bug here: https://bugs.openjdk.java.net/browse/JDK-8197398 which is still broken for a directory named "." instead of "/". FREQUENCY : always client-libs/java.awt: JDK-8211039: Removal of com.sun.awt.SecurityWarning Class The `com.sun.awt.SecurityWarning` class was deprecated as `forRemoval=true` in JDK 11 (JDK-8205588). This class was unused in the JDK and has been removed in this release. core-libs/java.io: JDK-8213888: Removal of finalize Methods from FileInputStream and FileOutputStream The `finalize` methods of `FileInputStream` and `FileOutputStream` were deprecated for removal in JDK 9. They have been removed in this release. The` java.lang.ref.Cleaner` has been implemented since JDK 9 as the primary mechanism to close file descriptors that are no longer reachable from `FileInputStream` and `FileOutputStream`. The recommended approach to close files is to explicitly call `close` or to use `try-with-resources`. hotspot/gc: JDK-8218905: ZGC: Concurrent Class Unloading The Z Garbage Collector now supports class unloading. By unloading unused classes, data structures related to these classes can be freed, lowering the overall footprint of the application. Class unloading in ZGC happens concurrently, without stopping the execution of Java application threads, and has zero impact on GC pause times. This feature is enabled by default, but can be disabled by using the command line option `-XX:-ClassUnloading`. JDK-8226474: Epsilon GC handled checked array stores incorrectly Epsilon GC may have violated the specification requirements by accepting the type-incompatible store into the array, instead of throwing the ArrayStoreException. This is now handled correctly, both in this release, and associated backports. Users are advised to upgrade as soon as possible. JDK-8211756: G1 May Uncommit Memory During Marking Cycle By default, G1 may now give back Java heap memory to the operating system during any concurrent mark cycle. G1 will respect default Java heap sizing policies at that time. This change improves memory usage of the Java process if the application does not need all memory. This behavior may be disabled in accordance with default heap sizing policies by setting minimum Java heap size to maximum Java heap size via the `-Xms` option. JDK-8215730: Allocation of Old Generation of Java Heap on Alternate Memory Devices This experimental feature in G1 and Parallel GC allows them to allocate the old generation of the Java heap on an alternative memory device such as NV-DIMM memory. Operating systems today expose NV-DIMM memory devices through the file system. Examples are NTFS DAX mode and ext4 DAX mode. Memory-mapped files in these file systems bypass the file cache and provide a direct mapping of virtual memory to the physical memory on the device. The specification of a path to an NV-DIMM file system by using the flag `-XX:AllocateOldGenAt=` enables this feature. There is no additional flag to enable this feature. When enabled, young generation objects are placed in DRAM only while old generation objects are always allocated in NV-DIMM. At any given point, the collector guarantees that the total memory committed in DRAM and NV-DIMM memory is always less than the size of the heap as specified by `-Xmx`. The current implementation pre-allocates the full Java heap size in the NV-DIMM file system to avoid problems with dynamic generation sizing. Users need to make sure there is enough free space on the NV-DIMM file system. When enabled, the VM also limits the maximum size of the young generation based on available DRAM, although it is recommended that users set the maximum size of the young generation explicitly. For example, if the VM is run with `-Xmx756g` on a system with 32GB DRAM and 1024GB NV-DIMM memory, the collector will limit the young generation size based on following calculation: 1. No `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is set to 80% of available memory (25.6GB). 2. `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is capped at 80% of available memory (25.6GB) regardless of the amount specified. 3. Users can use `-XX:MaxRAM` to let the VM know how much DRAM is available for use. If specified, maximum young gen size is set to 80% of the value in MaxRAM. 4. Users can specify the percentage of DRAM to use (instead of the default 80%) for young generation with `-XX:MaxRAMPercentage`. Enabling logging with the logging option `gc+ergo=info` will print the maximum young generation size at startup. JDK-8218905: ZGC: Concurrent Class Unloading The Z Garbage Collector now supports class unloading. By unloading unused classes, data structures related to these classes can be freed, lowering the overall footprint of the application. Class unloading in ZGC happens concurrently, without stopping the execution of Java application threads, and has zero impact on GC pause times. This feature is enabled by default, but can be disabled by using the command line option `-XX:-ClassUnloading`. JDK-8226474: Epsilon GC handled checked array stores incorrectly Epsilon GC may have violated the specification requirements by accepting the type-incompatible store into the array, instead of throwing the ArrayStoreException. This is now handled correctly, both in this release, and associated backports. Users are advised to upgrade as soon as possible. JDK-8211756: G1 May Uncommit Memory During Marking Cycle By default, G1 may now give back Java heap memory to the operating system during any concurrent mark cycle. G1 will respect default Java heap sizing policies at that time. This change improves memory usage of the Java process if the application does not need all memory. This behavior may be disabled in accordance with default heap sizing policies by setting minimum Java heap size to maximum Java heap size via the `-Xms` option. JDK-8215730: Allocation of Old Generation of Java Heap on Alternate Memory Devices This experimental feature in G1 and Parallel GC allows them to allocate the old generation of the Java heap on an alternative memory device such as NV-DIMM memory. Operating systems today expose NV-DIMM memory devices through the file system. Examples are NTFS DAX mode and ext4 DAX mode. Memory-mapped files in these file systems bypass the file cache and provide a direct mapping of virtual memory to the physical memory on the device. The specification of a path to an NV-DIMM file system by using the flag `-XX:AllocateOldGenAt=` enables this feature. There is no additional flag to enable this feature. When enabled, young generation objects are placed in DRAM only while old generation objects are always allocated in NV-DIMM. At any given point, the collector guarantees that the total memory committed in DRAM and NV-DIMM memory is always less than the size of the heap as specified by `-Xmx`. The current implementation pre-allocates the full Java heap size in the NV-DIMM file system to avoid problems with dynamic generation sizing. Users need to make sure there is enough free space on the NV-DIMM file system. When enabled, the VM also limits the maximum size of the young generation based on available DRAM, although it is recommended that users set the maximum size of the young generation explicitly. For example, if the VM is run with `-Xmx756g` on a system with 32GB DRAM and 1024GB NV-DIMM memory, the collector will limit the young generation size based on following calculation: 1. No `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is set to 80% of available memory (25.6GB). 2. `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is capped at 80% of available memory (25.6GB) regardless of the amount specified. 3. Users can use `-XX:MaxRAM` to let the VM know how much DRAM is available for use. If specified, maximum young gen size is set to 80% of the value in MaxRAM. 4. Users can specify the percentage of DRAM to use (instead of the default 80%) for young generation with `-XX:MaxRAMPercentage`. Enabling logging with the logging option `gc+ergo=info` will print the maximum young generation size at startup. JDK-8218905: ZGC: Concurrent Class Unloading The Z Garbage Collector now supports class unloading. By unloading unused classes, data structures related to these classes can be freed, lowering the overall footprint of the application. Class unloading in ZGC happens concurrently, without stopping the execution of Java application threads, and has zero impact on GC pause times. This feature is enabled by default, but can be disabled by using the command line option `-XX:-ClassUnloading`. JDK-8226474: Epsilon GC handled checked array stores incorrectly Epsilon GC may have violated the specification requirements by accepting the type-incompatible store into the array, instead of throwing the ArrayStoreException. This is now handled correctly, both in this release, and associated backports. Users are advised to upgrade as soon as possible. JDK-8211756: G1 May Uncommit Memory During Marking Cycle By default, G1 may now give back Java heap memory to the operating system during any concurrent mark cycle. G1 will respect default Java heap sizing policies at that time. This change improves memory usage of the Java process if the application does not need all memory. This behavior may be disabled in accordance with default heap sizing policies by setting minimum Java heap size to maximum Java heap size via the `-Xms` option. JDK-8215730: Allocation of Old Generation of Java Heap on Alternate Memory Devices This experimental feature in G1 and Parallel GC allows them to allocate the old generation of the Java heap on an alternative memory device such as NV-DIMM memory. Operating systems today expose NV-DIMM memory devices through the file system. Examples are NTFS DAX mode and ext4 DAX mode. Memory-mapped files in these file systems bypass the file cache and provide a direct mapping of virtual memory to the physical memory on the device. The specification of a path to an NV-DIMM file system by using the flag `-XX:AllocateOldGenAt=` enables this feature. There is no additional flag to enable this feature. When enabled, young generation objects are placed in DRAM only while old generation objects are always allocated in NV-DIMM. At any given point, the collector guarantees that the total memory committed in DRAM and NV-DIMM memory is always less than the size of the heap as specified by `-Xmx`. The current implementation pre-allocates the full Java heap size in the NV-DIMM file system to avoid problems with dynamic generation sizing. Users need to make sure there is enough free space on the NV-DIMM file system. When enabled, the VM also limits the maximum size of the young generation based on available DRAM, although it is recommended that users set the maximum size of the young generation explicitly. For example, if the VM is run with `-Xmx756g` on a system with 32GB DRAM and 1024GB NV-DIMM memory, the collector will limit the young generation size based on following calculation: 1. No `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is set to 80% of available memory (25.6GB). 2. `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is capped at 80% of available memory (25.6GB) regardless of the amount specified. 3. Users can use `-XX:MaxRAM` to let the VM know how much DRAM is available for use. If specified, maximum young gen size is set to 80% of the value in MaxRAM. 4. Users can specify the percentage of DRAM to use (instead of the default 80%) for young generation with `-XX:MaxRAMPercentage`. Enabling logging with the logging option `gc+ergo=info` will print the maximum young generation size at startup. JDK-8218905: ZGC: Concurrent Class Unloading The Z Garbage Collector now supports class unloading. By unloading unused classes, data structures related to these classes can be freed, lowering the overall footprint of the application. Class unloading in ZGC happens concurrently, without stopping the execution of Java application threads, and has zero impact on GC pause times. This feature is enabled by default, but can be disabled by using the command line option `-XX:-ClassUnloading`. JDK-8226474: Epsilon GC handled checked array stores incorrectly Epsilon GC may have violated the specification requirements by accepting the type-incompatible store into the array, instead of throwing the ArrayStoreException. This is now handled correctly, both in this release, and associated backports. Users are advised to upgrade as soon as possible. JDK-8211756: G1 May Uncommit Memory During Marking Cycle By default, G1 may now give back Java heap memory to the operating system during any concurrent mark cycle. G1 will respect default Java heap sizing policies at that time. This change improves memory usage of the Java process if the application does not need all memory. This behavior may be disabled in accordance with default heap sizing policies by setting minimum Java heap size to maximum Java heap size via the `-Xms` option. JDK-8215730: Allocation of Old Generation of Java Heap on Alternate Memory Devices This experimental feature in G1 and Parallel GC allows them to allocate the old generation of the Java heap on an alternative memory device such as NV-DIMM memory. Operating systems today expose NV-DIMM memory devices through the file system. Examples are NTFS DAX mode and ext4 DAX mode. Memory-mapped files in these file systems bypass the file cache and provide a direct mapping of virtual memory to the physical memory on the device. The specification of a path to an NV-DIMM file system by using the flag `-XX:AllocateOldGenAt=` enables this feature. There is no additional flag to enable this feature. When enabled, young generation objects are placed in DRAM only while old generation objects are always allocated in NV-DIMM. At any given point, the collector guarantees that the total memory committed in DRAM and NV-DIMM memory is always less than the size of the heap as specified by `-Xmx`. The current implementation pre-allocates the full Java heap size in the NV-DIMM file system to avoid problems with dynamic generation sizing. Users need to make sure there is enough free space on the NV-DIMM file system. When enabled, the VM also limits the maximum size of the young generation based on available DRAM, although it is recommended that users set the maximum size of the young generation explicitly. For example, if the VM is run with `-Xmx756g` on a system with 32GB DRAM and 1024GB NV-DIMM memory, the collector will limit the young generation size based on following calculation: 1. No `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is set to 80% of available memory (25.6GB). 2. `-XX:MaxNewSize` or `-Xmn` is specified: the maximum young generation size is capped at 80% of available memory (25.6GB) regardless of the amount specified. 3. Users can use `-XX:MaxRAM` to let the VM know how much DRAM is available for use. If specified, maximum young gen size is set to 80% of the value in MaxRAM. 4. Users can specify the percentage of DRAM to use (instead of the default 80%) for young generation with `-XX:MaxRAMPercentage`. Enabling logging with the logging option `gc+ergo=info` will print the maximum young generation size at startup. ALL FIXED ISSUES, BY COMPONENT AND PRIORITY: client-libs: (P2) JDK-8212213: All tests for splashscreen stopped worked in jdk12b13 (P2) JDK-8210776: Upgrade X Window System 6.8.2 to the latest XWD 1.0.7 (P3) JDK-8214002: Cannot use italic font style if the font has embedded bitmap (P3) JDK-8213614: DnD operation change feature does not work with 64bit big endian CPU (P3) JDK-8215364: JavaFX crashes on Ubuntu 18.04 with Wayland while using Swing-FX interop (P3) JDK-8208702: javax/swing/reliability/HangDuringStaticInitialization.java may hang on macos (P3) JDK-8208996: X11 icon window color handing bug (P4) JDK-8209123: [Macosx] Maximized frame (frame state set to MAXIMIZED_BOTH using setExtendedState) is resizable on Mac but not on Windows and Ubuntu (P4) JDK-8211693: Convert C-style array declarations in client demos and jdk.accessibility (P4) JDK-8211300: Convert C-style array declarations in JDK client code (P4) JDK-8198624: java/awt/KeyboardFocusmanager/TypeAhead/SubMenuShowTest/SubMenuShowTest.html fails on mac (P4) JDK-8186549: move ExtendedRobot closer to tests (P4) JDK-8208541: non-ASCII characters in hsdis UPL text (P4) JDK-8214470: PIT: javax/swing/JPopupMenu/7154841/bug7154841.java errors out on mac10.13 (P4) JDK-8211822: Some tests fail after JDK-8210039 (P4) JDK-8197810: Test java/awt/Choice/SelectCurrentItemTest/SelectCurrentItemTest.html fails on Windows client-libs/2d: (P2) JDK-8212680: (JDK12b14/Solaris-sparc) SplashScreen::getSplashScreen call fails with ULE: "libsplashscreen.so: ld.so.1: java: fatal: libz.so.1: open failed: No such file or directory" (P2) JDK-8212040: Compilation error due to wrong usage of NSPrintJobDispositionValue in mac10.12 (P2) JDK-8216965: crash in freetypeScaler.c CopyBW2Grey8 (P2) JDK-8218020: Fix version number in mesa.md 3rd party legal file (P3) JDK-8201818: [macosx] Printing attributes break page size set via "java.awt.print.Book" object (P3) JDK-8214558: bad @run tag in CheckPrinterJobSystemProperty.java (P3) JDK-8210335: Clipping problems with complex affine transforms: negative scaling factors or small scaling factors (P3) JDK-8210447: Incorrect font rendering under Windows LAF (P3) JDK-7017058: Malayalam glyph substitution is failing for Malayalam with Windows Kartika font. (P3) JDK-8212071: Need to set the FreeType LCD Filter to reduce fringing. (P3) JDK-8211055: Provide print to a file (PDF) feature even when printer was not connected (P3) JDK-8210384: SunLayoutEngine.isAAT() font is expensive on MacOS (P4) JDK-8130264: Change the mechanism by which JDK loads the platform-specific PrinterJob implementation (P4) JDK-8213051: Invalid use of HTML5 in javax.print files (P4) JDK-8212790: Javadoc cleanup of java.awt.color package (P4) JDK-8056217: Remove awt_makecube.cpp (P4) JDK-8212703: Remove sun.java2d.fontpath property from java launcher code (P4) JDK-8210707: Some line shaped characters are not displayed without Anti Aliasing (P4) JDK-8213568: Typo in java/awt/GraphicsEnvironment/LoadLock/GE_init5.java (P4) JDK-8209548: Unused and incorrect calls to FT_Get_Char_Index (P4) JDK-8139178: Wrong fontMetrics when printing in Landscape (OpenJDK) client-libs/java.awt: (P2) JDK-8215280: Double click on titlebar not working for Frame with extended state set to MAXIMIZED_BOTH (P2) JDK-8213583: Error while opening the JFileChooser when desktop contains shortcuts pointing to deleted files (P2) JDK-8213944: Fix AIX build after the removal of Xrandr.h and add a configure check for it (P2) JDK-8213292: Input freezes after MacOS key-selector (press&hold) usage on macOS Mojave (P2) JDK-8215921: There is no change when select different Foreground and Background by mouse. (P3) JDK-8213817: @return has already been specified (4 occurrences, in AWT and Swing) (P3) JDK-8191178: [macos] Problem with input of yen symbol (P3) JDK-8211301: [macos] support full window content options (P3) JDK-8146310: [macosx] com.apple.eawt.Application.setDefaultMenuBar does not initialize screen menu bar (P3) JDK-8213983: [macosx] Keyboard shortcut “cmd +`” stops working properly if popup window is displayed (P3) JDK-8214120: [REDO] Fix sun.awt.nativedebug on X11 platforms (P3) JDK-8014503: AWT Choice implementation should be made consistent across platforms. (P3) JDK-8204142: AWT hang occurs when sequenced events arrive out of sequence in multiple AppContexts. (P3) JDK-8202702: Clearing selection on JTable causes disappearance of a row (P3) JDK-8203406: Exception in thread "AWT-EventQueue-0" java.lang.NullPointerException (P3) JDK-8211435: Exception in thread "AWT-EventQueue-1" java.lang.IllegalArgumentException: null source (P3) JDK-8182041: File Chooser Shortcut Panel folders under on JDK 9 (P3) JDK-8214007: Fix sun.awt.nativedebug on X11 platforms (P3) JDK-8211992: GraphicsConfiguration.getDevice().getDisplayMode() causes JVM crash on Mac (P3) JDK-8213048: Invalid use of HTML5 in java.awt files (P3) JDK-8130655: OS X: keyboard input in textfield is not possible if the window contained textfield is owned by EmbeddedFrame (P3) JDK-8210880: Remove HPKeysym.h from JDK sources (P3) JDK-8210886: Remove references in xwindows.md to non-existent files. (P3) JDK-8210863: Remove Xrandr include files from JDK sources (P3) JDK-8170937: Swing apps are slow if displaying from a remote source to many local displays (P3) JDK-8210692: The "com.sun.awt.SecurityWarning" class can be dropped (P3) JDK-8207070: Webstart app popup on wrong screen in a one-screen setup changing to multi-monitor (P4) JDK-8202886: [macos] Test java/awt/MenuBar/8007006/bug8007006.java fails on MacOS (P4) JDK-8039082: [TEST_BUG] Test java/awt/dnd/BadSerializationTest/BadSerializationTest.java fails (P4) JDK-8213532: add missing LocalFree calls after using FormatMessage(A) [windows] (P4) JDK-8209115: adjust libsplashscreen linux ppc64le builds for easier libpng update (P4) JDK-8211317: avoid memory leak in Java_sun_awt_UNIXToolkit_load_1stock_1icon (P4) JDK-8214380: AwtDragSource function LoadCache misses a ReleaseLongArrayElements in special case (P4) JDK-8205537: Drop of sun.applet package (P4) JDK-8210286: Drop of sun.awt.HToolkit class (P4) JDK-8214343: Handle the absence of Xrandr more generically (P4) JDK-8198002: java/awt/Mixing/Validating.java debug assert on Windows (P4) JDK-8211833: Javadoc cleanup of java.applet package (P4) JDK-8210306: Missing closing bracket in GridBagLayout gridwidth, gridheight description (P4) JDK-8205479: OS X: requestFocus() does not work properly for embedded frame (P4) JDK-8211218: remove double semicolon in src/java.desktop/macosx/classes/sun/font/CFont.java (P4) JDK-8213213: Remove src/java.desktop/unix/classes/sun/awt/X11/keysym2ucs.h (P4) JDK-8203263: Remove unnecessary throws clauses from serialization-related methods (P4) JDK-8211810: X11 Time stamp data should be unsigned (P5) JDK-8209340: The code which avoids synthetic accessors has become outdated client-libs/java.awt:i18n: (P3) JDK-8211393: Memory leak issue on awt_InputMethod.c (P4) JDK-8213183: InputMethod cannot be used after its restarting client-libs/java.beans: (P4) JDK-8211147: Incorrect comparator com.sun.beans.introspect.MethodInfo.MethodOrder client-libs/javax.accessibility: (P3) JDK-8133713: [macosx] Accessible JTables always reported as empty (P3) JDK-7124293: [macosx] VoiceOver reads percentages rather than the actual values for sliders. (P3) JDK-7124301: [macosx] When in a tab group if you arrow between tabs there are no VoiceOver announcements. (P4) JDK-8061359: [macosx] Checkbox toggles on Space press but does not spoken by Voice Over client-libs/javax.imageio: (P2) JDK-8212116: IIOException "tEXt chunk length is not proper" on opening png file (P3) JDK-8211795: ArrayIndexOutOfBoundsException in PNGImageReader after JDK-6788458 (P3) JDK-8214817: Bad links in ImageInputStream.java & ImageOutputStream.java (P3) JDK-8212865: Broken external link to TIFF6.pdf in ImageIO package-info.java (P3) JDK-8212875: ftp: links for tiff/TTN2.draft.txt do not respond (P3) JDK-8211422: Reading PNG with corrupt CRC for IEND chunk throws IIOException (P4) JDK-8214876: Add "intermittent" key for imageio/stream/StreamCloserLeak/run_test.sh client-libs/javax.sound: (P3) JDK-8207150: Clip.isRunning() may return true after Clip.stop() was called (P4) JDK-8211962: Implicit narrowing in MacOSX java.desktop jsound client-libs/javax.swing: (P2) JDK-8206392: [macosx] Cycling through windows (JFrames) does not work with keyboard shortcut (P2) JDK-8213843: Changing L&F from Nimbus to Window L&F causes NPE in SwingSet2 (P2) JDK-8187364: Unable to enter zero width non-joiner (ZWNJ) symbol in Swing text component (P3) JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called (P3) JDK-8192888: AllSwingComponentsBaselineTest fails with NullPointerException for NimbusLookAndFeel (P3) JDK-8211886: Bad/broken link in synthFileFormat.html (P3) JDK-8210739: Calling JSpinner's setFont with null throws NullPointerException (P3) JDK-8209494: Create a test for SwingSet3 InternalFrameDemo (P3) JDK-8209993: Create a test for SwingSet3 ToolTipDemo (P3) JDK-8210910: Create test for FileChooserDemo (P3) JDK-8209499: Create test for SwingSet3 EditorPaneDemo (P3) JDK-8210994: Create test for SwingSet3 FrameDemo (P3) JDK-8213168: Enable different look and feel tests in SwingSet3 demo test FileChooserDemoTest (P3) JDK-8210056: Enable different look and feel tests in SwingSet3 demo test TextFieldDemoTest (P3) JDK-8210055: Enable different look and feel tests in SwingSet3 demo tests (P3) JDK-8210057: Enable different look and feels in SwingSet3 demo test InternalFrameDemoTest (P3) JDK-8211443: Enable different look and feels in SwingSet3 demo test SplitPaneDemoTest (P3) JDK-8210052: Enable testing for all the available look and feels in SwingSet3 demo tests (P3) JDK-8211760: HTMLDocument.wait() thread lock after calling JPanel.pack() at startup (P3) JDK-8208638: Instead of circle rendered in appl window, but ellipse is produced JEditor Pane (P3) JDK-8213049: Invalid HTML5 in javax.swing files (P3) JDK-8204963: javax.swing.border.TitledBorder has a memory leak (P3) JDK-8202013: JEditorPane shows large HTML unordered list bullets (P3) JDK-8201925: JEditorPane unordered list bullets look pixelated (P3) JDK-8211987: Menu bar gets input focus even if Alt-released event is consumed (P3) JDK-8211031: Remove un-needed qualified export to java.desktop from java.base on macos (P3) JDK-8212897: Some improvements in the EditorPaneDemotest (P3) JDK-8209789: Synchronize test/jdk/sanity/client/lib/jemmy with code-tools/jemmy/v2 (P3) JDK-8213261: test javax/swing/plaf/nimbus/AllSwingComponentsBaselineTest.java fails (P3) JDK-8213934: Text size too small on HiDPI monitors when using Windows L&F (P3) JDK-8205535: Useless (or buggy) call to Math.round on int input (P4) JDK-8208543: [macos] Support for apple.awt.documentModalSheet incomplete. (P4) JDK-6821316: comment in source code of SynthStyleFactory.java has a self-reference (P4) JDK-8212735: Compilation issue with javax.swing.InputVerifier example in javadoc section (P4) JDK-6994403: Grammatical error in documentation of javax.swing.GroupLayout.ParallelGroup (P4) JDK-8213121: javax/swing/GraphicsConfigNotifier/StalePreferredSize.java fails on mac10.13 (P4) JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/WindowsComboBoxSizeTest.java fails in Windows (P4) JDK-8198321: javax/swing/JEditorPane/5076514/bug5076514.java fails (P4) JDK-8202656: javax/swing/JEditorPane/8195095/ImageViewTest.java fails on Windows (P4) JDK-8203904: javax/swing/JSplitPane/4816114/bug4816114.java: The divider location is wrong (P4) JDK-8212882: links to tutorial should be updated to use https: (P4) JDK-8214943: PIT: javax/swing/JFrame/NSTexturedJFrame/NSTexturedJFrame.java errors out in mac (P4) JDK-8198339: Test javax/swing/border/Test6981576.java is unstable (P4) JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful (P4) JDK-8199072: Test javax/swing/GroupLayout/6613904/bug6613904.java is unstable (P4) JDK-8198398: Test javax/swing/JColorChooser/Test6199676.java fails in mach5 (P4) JDK-8206343: There is a typo in the java documentation of javax.swing.JScrollBar. (P4) JDK-6828982: UIDefaults.getUI swallows original exception core-libs: (P1) JDK-8207748: Fix for 8202794 breaks tier1 builds (P2) JDK-8213151: [AIX] Some class library files are missing the Classpath exception (P2) JDK-8213043: Add internal Unsafe xxxObject methods as jsr166 is broken (P2) JDK-8211097: aix: fix build after JDK-8210919 (P2) JDK-8214552: Resolve clash between 4947890 and 8130264 (P2) JDK-8214431: tests failed because can't find jdk.testlibrary.* in test directory or libraries (P3) JDK-8214063: [AIX] Disable symbol visibility flags (P3) JDK-8211122: Reduce the number of internal classes made accessible to jdk.unsupported (P3) JDK-8210766: Remove obsolete qualified export sun.net.www to java.desktop (P3) JDK-8205615: Start of release updates for JDK 12 (P3) JDK-8205128: Umbrella: JDK 12 terminal deprecations (P4) JDK-8205610: [TESTLIB] Improve listing of open file descriptors (P4) JDK-8212045: Add back the tests that were removed from HashesTest.java and AddExportsTest.java (P4) JDK-8211804: Constant AO_UNUSED_MBZ uses left shift of negative value (P4) JDK-8215309: Convert package.html files to package-info.java files (P4) JDK-8211149: fix potential memleak in getJavaIDFromLangID after failing SetupI18nProps call [windows] (P4) JDK-8209786: JDK12 fails to build on s390x with gcc 7.3 (P4) JDK-8202794: Native Unix code should use readdir rather than readdir_r (P4) JDK-8213913: Redundant HTML in java.se/module-info.java (P4) JDK-8206440: Remove javac -source/-target 6 from jdk regression tests (P4) JDK-8212948: Remove unused jdk.internal.misc.VMNotification interface (P4) JDK-8211071: unpack.cpp fails to compile with statement has no effect [-Werror=unused-value] (P4) JDK-8212001: Verify exported symbols in java.base (libjava) (P4) JDK-8212000: Verify exported symbols in java.base (libnet, libnio/ch) (P5) JDK-8210347: Combine subsequent calls to Set.contains() and Set.add() (P5) JDK-8200381: Typos in javadoc - missing verb "be" and alike core-libs/java.io: (P2) JDK-8210345: The Japanese message of FileNotFoundException garbled. (P3) JDK-8207005: Disable the file canonicalization cache by default (P3) JDK-6516099: InputStream.skipFully(int k) to skip exactly k bytes (P3) JDK-8192939: Remove Finalize methods from FileInputStream and FileOutputStream (P4) JDK-8211859: Avoid initializing AtomicBoolean from RandomAccessFile (P4) JDK-8209837: Avoid initializing ExpiringCache during bootstrap (P4) JDK-8207744: Clean up inconsistent use of opendir/closedir versus opendir64/closedir64 (P4) JDK-8207060: Memory leak when malloc fails within WITH_UNICODE_STRING block (P4) JDK-8207750: Native handle leak in java.io.WinNTFileSystem.list() (P4) JDK-8204310: Simpler RandomAccessFile.setLength() on Windows (P4) JDK-8211163: UNIX version of Java_java_io_Console_echo does not return a clean boolean (P5) JDK-8207016: Avoid redundant native memory allocation in getFinalPath() core-libs/java.io:serialization: (P3) JDK-8211121: Remove sun.reflect.ReflectionFactory::newInstanceForSerialization core-libs/java.lang: (P2) JDK-8215489: Remove String::align (P2) JDK-8210841: test/jdk/vm/runtime/ReflectStackOverflow.java fails with NoClassDefFoundError (P2) JDK-8212694: Using Raw String Literals with align() and Integer.MIN_VALUE causes out of memory error (P3) JDK-5075463: (enum) Serialized Form javadoc for java.lang.Enum is misleading (P3) JDK-8215380: Backout accidental change to String::length (P3) JDK-8211876: Broken links in java.base files (ClassLoader.html#name) (P3) JDK-8211957: Broken links to stylesheet in java.base/doc-files (P3) JDK-8212880: Cannot access ftp: site for fdlibm.tar (P3) JDK-8210031: implementation for JVM Constants API (P3) JDK-8185496: Improve performance of system properties initialization in initPhase1 (P3) JDK-8215194: Initial size of UnicodeBlock map is incorrect (P3) JDK-8214794: java.specification.version should be only the major version number (P3) JDK-8171426: java/lang/ProcessBuilder/Basic.java failed with Stream closed (P3) JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails with -XX:+DeoptimizeALot (P3) JDK-8196005: Library support for Raw String Literals (P3) JDK-4947890: Minimize JNI upcalls in system-properties initialization (P3) JDK-8214696: Module class should be filtered by core reflection (P3) JDK-8210721: Replace legacy serial exception field with Throwable::cause (P3) JDK-8200434: String::align, String::indent (P3) JDK-8215493: String::indent inconsistency with blank lines (P3) JDK-8203442: String::transform (P3) JDK-8215112: String::transform spec clarification (P3) JDK-8210004: Thread.sleep(millis, nanos) timeout returns early (P3) JDK-8213820: unknown tag: @returns (P3) JDK-8214567: Use {@systemProperty} for definitions of system properties (P3) JDK-8213920: Use {@systemProperty} tag for properties listed in System.getProperties (P4) JDK-8212828: (process) Provide a way for Runtime.exec to use posix_spawn on linux (P4) JDK-8176425: Add radix indication in NumberFormatException message for Integer.decode (P4) JDK-8208715: Conversion of milliseconds to nanoseconds in UNIXProcess contains bug. (P4) JDK-8207753: Handle to process snapshot is leaked if Process32First() fails (P4) JDK-8215159: Improve initial setup of system Properties (P4) JDK-8212662: javadoc typo in java.lang.ref.Cleaner (P4) JDK-8213017: jspawnhelper: need to handle pipe write failure when sending return code (P4) JDK-8199394: Object.hashCode should not mention anything about memory addresses (P4) JDK-8210787: Object.wait(long, int) throws inappropriate IllegalArgumentException (P4) JDK-8206495: Redundant System.setProperty(null) tests (P4) JDK-8214971: Replace use of string.equals("") with isEmpty() (P4) JDK-8098798: Thread.join(ms) on Linux still affected by changes to the time-of-day clock (P4) JDK-8189717: Too much documentation of ProcessBuilder.start copied to ProcessBuilder.startPipeline (P4) JDK-8213046: Update java.lang.Character javadoc for Japanese New Era character (P4) JDK-8215281: Use String.isEmpty() when applicable in java.base (P4) JDK-8213424: VersionProps duplicate and skipped initialization (P5) JDK-8209171: Simplify Java implementation of Integer/Long.numberOfTrailingZeros() core-libs/java.lang.invoke: (P2) JDK-8211921: AssertionError in MethodHandles$Lookup.defineClass (P3) JDK-8215300: additional changes to constants API (P3) JDK-8215510: j.l.c.ClassDesc is accepting descriptors not allowed by the spec (P3) JDK-8203252: JEP 334: JVM Constants API (P3) JDK-8213478: Reduce rebinds when applying repeated filters and conversions (P3) JDK-8215648: remove equals and hashCode implementations from j.l.i.VarHandle (P3) JDK-8207146: Rename jdk.internal.misc.Unsafe::xxxObject to xxxReference (P4) JDK-8207816: Align declaration of SerializedLambda.readResolve with serialization conventions (P4) JDK-8209633: Avoid creating WeakEntry wrappers when looking up cached MethodType (P4) JDK-8213741: Consolidate Object and String Stringifiers (P4) JDK-8206955: MethodHandleProxies.asInterfaceInstance does not support default methods (P4) JDK-8212597: Optimize String concatenation setup when using primitive operands (P4) JDK-8213035: Pack MethodHandleInlineStrategy coder and length into a long (P4) JDK-8212726: Replace some use of drop- and foldArguments with filtering argument combinator in StringConcatFactory (P4) JDK-8181443: Replace usages of jdk.internal.misc.Unsafe with MethodHandles.Lookup.defineClass (P4) JDK-8210366: Typo in MethodHandles.Lookup: must be either be (P5) JDK-8177275: IllegalArgumentException when MH would have too many parameters is not specified for several methods core-libs/java.lang.module: (P3) JDK-8213056: Nested anchor tags in java.lang.module (P4) JDK-8209003: Consolidate use of empty collections in java.lang.module (P4) JDK-8214858: Improve module graph archiving (P4) JDK-8215301: Module-summary page is unreadably wide (P4) JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup delegation when module reads automatic module (P5) JDK-8208998: Typo in ModuleInfo.java, field for ModuleHashes should be moduleHashes core-libs/java.lang:class_loading: (P4) JDK-8215048: Some classloader typos core-libs/java.lang:reflect: (P3) JDK-8198526: getAnnotatedOwnerType does not handle static nested classes correctly (P3) JDK-8206240: java.lang.Class.newInstance() is causing caller to leak (P3) JDK-8208364: java/lang/reflect/callerCache/ReflectionCallerCacheTest.java missing module dependencies declaration (P3) JDK-8213444: Missing emphasis for term being defined (P3) JDK-8213299: runtime/appcds/jigsaw/classpathtests/EmptyClassInBootClassPath.java failed with java.lang.NoSuchMethodException (P4) JDK-6304578: (reflect) toGenericString fails to print bounds of type variables on generic methods (P4) JDK-8058202: AnnotatedType implementations don't override toString(), equals(), hashCode() (P4) JDK-8212081: AnnotatedType.toString implementation don't print annotations on embedded types (P4) JDK-8210496: Improve filtering for classes with security sensitive fields core-libs/java.math: (P3) JDK-8152910: Get performance improvement with Stable annotation core-libs/java.net: (P1) JDK-8218662: Allow 204 responses with Content-Length:0 (P1) JDK-8214460: MacosX build is broken because of JDK-8214014 (P1) JDK-8218546: Unable to connect to https://google.com using java.net.HttpClient (P2) JDK-8215292: Back out changes for node- and link- local ipv6 multicast address (P2) JDK-8208391: Differentiate response and connect timeouts in HTTP Client API (P2) JDK-8211146: fix problematic elif-tests after recent gcc warning changes Werror=undef (P2) JDK-8213418: Socket/ServerSocket supportedOptions does not work with custom SocketImpl (P3) JDK-8210147: adjust some WSAGetLastError usages in windows network coding (P3) JDK-8211349: Bad HTML in {@link} for HttpResponse.BodyHandlers.ofPublisher (P3) JDK-8207265: Bad HTML in {@link} in HttpResponse.BodySubscribers.ofPublisher (P3) JDK-8211902: broken link in java.net.http.WebSocket.Builder (P3) JDK-8215008: Clear confusion between URL/URI paths and file system paths (P3) JDK-8207846: Generalize the jdk.net.includeInExceptions security property (P3) JDK-8046500: GetIpAddrTable function failed on Pure Ipv6 environment (P3) JDK-8213910: Invalid HTML in java.net.http.HttpClient (P3) JDK-8203850: java.net.http HTTP client should allow specifying Origin and Referer headers (P3) JDK-8203672: JNI exception pending in PlainSocketImpl.c (P3) JDK-8207960: Non-negative WINDOW_UPDATE increments may leave the stream window size negative (P3) JDK-8212114: Reconsider the affect on closed streams resulting from 8189366 (P3) JDK-8189366: SocketInputStream.available() should check for eof (P3) JDK-8207959: The initial value of SETTINGS_MAX_CONCURRENT_STREAMS should have no limit (P3) JDK-8213942: URLStreamHandler initialization race (P3) JDK-8213921: Use {@systemProperty} tag for properties listed in "Networking Properties" (P3) JDK-8209994: windows: Java_java_net_NetworkInterface_getAll misses releasing interface-list (P4) JDK-8209454: [error-prone] TypeParameterUnusedInFormals in jdk.net (P4) JDK-8214445: [test] java/net/URL/HandlerLoop has illegal reflective access (P4) JDK-8211927: Add additional diagnostic information to java/net/BindException/Test.java (P4) JDK-8210493: Bind to node- or linklocal ipv6 multicast address fails (P4) JDK-8213210: Change ServerSocket(SocketImpl impl) constructor to protected access (P4) JDK-8211420: com.sun.net.httpserver.HttpServer returns Content-length header for 204 response code (P4) JDK-8212926: HttpClient does not retrieve files with large sizes over HTTP/1.1 (P4) JDK-8210311: IllegalArgumentException in CookieManager - Comparison method violates its general contract (P4) JDK-8211842: IPv6_supported wrongly returns false when unix domain socket is bound to fd 0 (P4) JDK-8211437: java.net.http.HttpClient hangs on 204 reply without Content-length 0 (P4) JDK-8213189: Make restricted headers in HTTP Client configurable and remove Date by default (P4) JDK-8211978: Move testlibrary/jdk/testlibrary/SimpleSSLContext.java and testkeys to network testlibrary (P4) JDK-8207404: MulticastSocket tests failing on AIX (P4) JDK-8214295: Populate handlers while holding streamHandlerLock (P4) JDK-8194899: Remove unused sun.net classes (P4) JDK-8214014: Remove vestiges of gopher: protocol proxy support (P4) JDK-8187522: test/sun/net/ftp/FtpURLConnectionLeak.java timed out (P4) JDK-8213616: URLPermission with query or fragment behaves incorrectly (P4) JDK-8213911: Use example.com in java.net and other examples (P4) JDK-8200191: Verify exported symbols in java.base (P5) JDK-8213490: Networking area typos and inconsistencies cleanup core-libs/java.nio: (P3) JDK-8202252: (aio) Closed AsynchronousSocketChannel keeps completion handler alive (P3) JDK-8213366: (fs) avoid handle leak in Java_sun_nio_fs_WindowsNativeDispatcher_FindFirstFile0 (P3) JDK-8206448: (fs) Extended attributes assumed to be enabled on ext3 (lnx) (P3) JDK-8213406: (fs) More than one instance of built-in FileSystem observed in heap (P3) JDK-8197398: (zipfs) Files.walkFileTree walk indefinitelly while processing JAR file with "/" as a directory inside. (P3) JDK-8210394: (zipfs) jdk/nio/zipfs/ZFSTests.java rootdir.zip: The process cannot access the file because it is being used by another process (P3) JDK-8211385: (zipfs) ZipDirectoryStream yields a stream of absolute paths when directory is relative (P3) JDK-8210899: (zipfs) ZipFileSystem.EntryOutputStreamCRC32 mistakenly set the crc32 value into size field (P4) JDK-8212212: (bf) Incorrect path to stream preprocessor source in java.nio Buffer test scripts (P4) JDK-8208362: (bf) Long chains created by direct Buffer::slice (P4) JDK-8210279: (bf) Remove unused package private method java.nio.Buffer.truncate() (P4) JDK-8202285: (fs) Add a method to Files for comparing file contents (P4) JDK-8207145: (fs) Native memory leak in WindowsNativeDispatcher.LookupPrivilegeValue0 (P4) JDK-8214078: (fs) SecureDirectoryStream not supported on arm32 (P4) JDK-8210341: (fs) Typos in PosixFileAttributeView javadoc (P4) JDK-8207340: (fs) UnixNativeDispatcher close and readdir usages should be fixed (P4) JDK-8186766: (fs) UnixNativeDispatcher::readlink() may truncate overlong paths (P4) JDK-8209152: (so) ServerSocketChannel::supportedOptions includes IP_TOS (P4) JDK-8034802: (zipfs) newFileSystem throws UOE when the zip file is located in a custom file system (P4) JDK-8210817: Minor typo in java.nio.file.attribute package summary (P4) JDK-8193822: Remove unused newDirectByteBuffer and truncate methods from buffer classes (P4) JDK-8210741: Typo in Java API documentation of java.nio.file.Paths core-libs/java.nio.charsets: (P3) JDK-8212794: IBM-964 is required for AIX default charset (P3) JDK-8213618: IBM970 charset has missing entry and remove unexpected entries (P3) JDK-8211382: ISO2022JP and GB18030 NIO converter issues (P3) JDK-8209576: java.nio.file.Files.writeString writes garbled UTF-16 instead of UTF-8 (P4) JDK-8208634: Add x-IBM-1129 charset (P5) JDK-8210285: CharsetDecoder/Encoder's constructor does not reject NaN core-libs/java.rmi: (P3) JDK-8211068: rmic does not support classes compiled with the option --enable-preview (P3) JDK-8214569: Use {@systemProperty} for definitions of system properties (P4) JDK-8209382: [error-prone] HashtableContains in sun/rmi/server/ActivationGroupImpl.java core-libs/java.sql: (P3) JDK-8211295: DriverManager::getConnection fails to find driver if it's called from JDBC RowSet (P4) JDK-8208060: Additional corrections of serial-related declarations core-libs/java.text: (P3) JDK-8177552: Compact Number Formatting support (P3) JDK-8209923: Unicode 11 (P4) JDK-8021322: [Fmt-Ch] Implementation of ChoiceFormat math methods should delegate to java.lang.Math methods (P4) JDK-8208560: ChoiceFormat class has unused constants needs cleanup (P4) JDK-8193444: SimpleDateFormat throws ArrayIndexOutOfBoundsException when format contains long sequences of unicode characters core-libs/java.time: (P2) JDK-8213085: (tz) Upgrade time-zone data to tzdata2018g (P2) JDK-8216176: Clarify the singleton description in j.t.c.JapaneseEra class (P2) JDK-8217892: Clarify the support for the new Japanese era in java.time.chrono.JapaneseEra (P2) JDK-8212941: Support new Japanese era in java.time.chrono.JapaneseEra (P3) JDK-8213818: @return has already been specified (P3) JDK-8211952: Broken links in java.time API (P4) JDK-8210633: Cannot parse JapaneseDate string with DateTimeFormatterBuilder Mapped-values (P4) JDK-8166138: DateTimeFormatter.ISO_INSTANT should handle offsets (P4) JDK-8207751: Remove misleading serialVersionUID from JulienFields.Field core-libs/java.util: (P3) JDK-8213325: (props) Properties.loadFromXML does not fully comply with the spec (P3) JDK-8212870: Broken links for www.usno.navy.mil (P3) JDK-8212878: host in ftp: link not found (P4) JDK-8207393: ServiceLoader class description improvements core-libs/java.util.concurrent: (P2) JDK-8215326: Test java/util/concurrent/ConcurrentHashMap/ToArray.java hangs after j.u.c updates (P3) JDK-8211877: Broken links in java.util.concurrent.atomic (P3) JDK-8212899: java/util/concurrent/tck/JSR166TestCase.java - testMissedSignal_8187947(SubmissionPublisherTest): timed out waiting for CountDownLatch for 40 sec (P3) JDK-8205620: Miscellaneous changes imported from jsr166 CVS 2018-07 (P3) JDK-8207003: Miscellaneous changes imported from jsr166 CVS 2018-09 (P3) JDK-8211283: Miscellaneous changes imported from jsr166 CVS 2018-11 (P3) JDK-8214457: Miscellaneous changes imported from jsr166 CVS 2018-12 (P3) JDK-8214559: Use {@systemProperty} for definitions of system properties (P4) JDK-8210971: Add exception handling methods to CompletionStage and CompletableFuture (P4) JDK-8214427: probable bug in logic of ConcurrentHashMap.addCount() core-libs/java.util.jar: (P3) JDK-8211860: Avoid reading security properties eagerly on Manifest class initialization (P3) JDK-8216362: Better error message handling when there is an invalid Manifest (P3) JDK-8211880: Broken links in java.util.jar (P3) JDK-8205525: Improve exception messages during manifest parsing of jar archives (P3) JDK-8206389: JarEntry.setCreation/LastAccessTime without setLastModifiedTime causes Invalid CEN header (P3) JDK-8211765: JarFile constructor throws undocumented java.nio.file.InvalidPathException (P3) JDK-8211728: JarFile::versionedStream() does not filter META-INF resources in versioned stream (P3) JDK-8212129: Remove Finalize methods from ZipFile, Inflater and Deflater (P3) JDK-8214744: Unnecessary

tags in java.util.zip.Deflater (P4) JDK-8206863: A closed JarVerifier.VerifierStream should throw IOException core-libs/java.util.logging: (P3) JDK-8211960: broken links in java.util.logging (P4) JDK-8209456: [error-prone] ShortCircuitBoolean in java.logging (P4) JDK-8209987: Minor cleanup in Level.java (P5) JDK-8211093: Default logging.properties sets log level for com.xyz.foo core-libs/java.util.regex: (P5) JDK-8211396: Broken link in javadoc for private java.util.regex.Pattern#normalize() core-libs/java.util.stream: (P4) JDK-8205461: Create Collector which merges results of two other collectors core-libs/java.util:collections: (P3) JDK-8214745: Bad link in coll-reference.html (P3) JDK-8211882: Broken links in serialized-form.html (P4) JDK-7033681: Arrays.asList methods needs better documentation (P4) JDK-8205399: Set node color on pinned HashMap.TreeNode deletion (P5) JDK-8206123: ArrayDeque created with default constructor can only hold 15 elements (P5) JDK-8207314: Unnecessary reallocation when constructing WeakHashMap from a large Map core-libs/java.util:i18n: (P2) JDK-8208080: Locale extensions via Service provider is not working for region extensions (P2) JDK-8210153: localized currency symbol of VES (P2) JDK-8210490: TimeZone.getDisplayName given Locale.US doesn't always honor the Locale (P3) JDK-8206120: Add test cases for lenient Japanese era parsing (P3) JDK-8211961: Broken link in java.util.Locale (P3) JDK-8208746: ISO 4217 Amendment #168 Update (P3) JDK-8209775: ISO 4217 Amendment #169 Update (P3) JDK-8206886: Java does not set the default format locale correctly on mac10.13 (P3) JDK-8072130: java/lang/instrument/BootClassPath/BootClassPathTest.sh fails on Mac OSX (P3) JDK-8214498: java/util/Locale/bcp47u/SystemPropertyTests.java wrong locale default (P3) JDK-8211398: Square character support for the Japanese new era (P3) JDK-8209880: tzdb.dat is not reproducibly built (P3) JDK-8213294: Upgrade IANA LSR data (P3) JDK-8209167: Use CLDR's time zone mappings for Windows (P4) JDK-8210142: java.util.Calendar.clone() doesn't respect sharedZone flag (P4) JDK-8210443: Migrate Locale matching tests to JDK Repo. (P4) JDK-8214170: ResourceBundle.Control.newBundle should throw IllegalAccessException when constructor of the resource bundle is not public. core-libs/javax.annotation.processing: (P4) JDK-8208200: Add missing periods to sentences in RoundEnvironment specs (P4) JDK-8213256: Clarify runtime vs compile time annotations for RoundEnvironment.getElementsAnnotatedWith(Class) core-libs/javax.lang.model: (P3) JDK-8216322: Missing since information in deprecation of constructor visitors (P4) JDK-8193292: Add SourceVersion.RELEASE_12 (P4) JDK-8173606: Deprecate constructors of 7-era visitors (P4) JDK-8208201: Update SourceVersion.RELEASE_11 docs to mention var for lambda param core-libs/javax.naming: (P2) JDK-8205330: InitialDirContext ctor sometimes throws NPE if the server has sent a disconnection (P2) JDK-8211107: LDAPS communication failure with jdk 1.8.0_181 (P4) JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider (P4) JDK-8211920: Close server socket and cleanups in test/jdk/javax/naming/module/RunBasic.java (P4) JDK-8176553: LdapContext follows referrals infinitely ignoring set limit core-libs/javax.sql: (P4) JDK-8208782: Remove extra type in throws clause of SerialClob.writeObject core-libs/jdk.nashorn: (P4) JDK-8214795: Add safety check to dynalink inner class lookup (P4) JDK-8214525: Bit rot in Nashorn Ant script (P4) JDK-8210943: Hiding of inner classes not resolved properly core-svc/debugger: (P3) JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related tests (P3) JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2 (P3) JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java version - step3 (P3) JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java version - step4 (P3) JDK-8199155: Accessibility issues in jdk.jdi (P3) JDK-8195703: BasicJDWPConnectionTest.java: 'App exited unexpectedly with 2' (P3) JDK-8210118: better jdb test diagnostics when getting "Prompt is not received during ... milliseconds" failures (P3) JDK-8211884: Broken links in JPDA, JDWP specs (P3) JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout (P3) JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails with waitForPrompt timed out after 60 seconds (P3) JDK-8213902: com/sun/jdi/SetLocalWhileThreadInNative.java times out (P3) JDK-8193879: Java debugger hangs on method invocation (P3) JDK-8211324: Link to java.lang.ThreadGroup in JDWP spec is broken (P3) JDK-8213916: no copyright in signature.html (P3) JDK-8169718: nsk/jdb/locals/locals002: ERROR: Cannot find boolVar with expected value: false (P3) JDK-8208471: nsk/jdb/unwatch/unwatch002/unwatch002.java fails with "Prompt is not received during 300200 milliseconds" (P3) JDK-8163083: SocketListeningConnector does not allow invocations with port 0 (P4) JDK-8206086: [Graal] JDI tests fail with com.sun.jdi.ObjectCollectedException (P4) JDK-8204695: [Graal] vmTestbase/nsk/jdi/ClassPrepareRequest/addSourceNameFilter/addSourceNameFilter002/addSourceNameFilter002.java fails (P4) JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh test (P4) JDK-8214061: Buffer written into itself (P4) JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC (P4) JDK-8210252: com/sun/jdi/DebuggerThreadTest.java fails with NPE (P4) JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57) - unexpected. lastLine=52, minLine=52, maxLine=55 (P4) JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed (P4) JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout (P4) JDK-8199811: com/sun/jdi/ProcessAttachTest.java fails intermittently: Remote thread failed for unknown reason (P4) JDK-8214892: Delayed starting of debugging via jcmd (P4) JDK-8210987: Extra newlines on Windows when running nsk jdb tests (P4) JDK-8213052: HTML errors in JPDA spec (P4) JDK-8211736: jdb doesn't print prompt when breakpoint is hit and suspend policy is STOP_EVENT_THREAD (P4) JDK-8212151: jdi/ExclusiveBind.java times out due to "bind failed: Address already in use" on Solaris-X64 (P4) JDK-8206007: nsk/jdb/exclude001 test is taking a long time on some builds (P4) JDK-8206330: Revisit com/sun/jdi/RedefineCrossEvent.java (P5) JDK-8212629: [TEST] wrong breakpoint in test/jdk/com/sun/jdi/DeferredStepTest core-svc/java.lang.management: (P2) JDK-8212197: OpenDataException thrown when constructing CompositeData for StackTraceElement (P2) JDK-8212795: ThreadInfoCompositeData.toCompositeData fails to map ThreadInfo to CompositeData core-svc/javax.management: (P3) JDK-8211951: Broken links in java.management files (P5) JDK-6254624: Clarify what restrictions a new connector protocol implementation must respect core-svc/tools: (P3) JDK-8214300: .attach_pid files may remain in the process cwd (P3) JDK-8176828: jtools do not list VM process launched with the debugger option suspend=y (P3) JDK-8209163: SA: Show Object Histogram asserts with ZGC (P4) JDK-8205992: jhsdb cannot attach to Java processes running in Docker containers (P4) JDK-8186548: move jdk.testlibrary.JcmdBase closer to tests (P4) JDK-8210106: sun/tools/jps/TestJps.java timed out deploy: (P3) JDK-8214805: Mark deprecated netscape.javascript.JSObject::getWindow API forRemoval=true docs: (P3) JDK-8066570: Highlight Charset aliases in encoding docs (P4) JDK-8218696: Broken link to AppCDS in JDK 11 documentation (P4) JDK-8218697: Typo in JDK 11 documentation - "the operation system." docs/guides: (P3) JDK-8213579: Document the System Property, javax.net.ssl.sessionCacheSize (P3) JDK-8208156: Each JCE provider should document the EC curves that they support (P3) JDK-8058585: Update security guides with information about using module URLs in policy files (P4) JDK-8210140: Java 11 migration guide : Provide simple indication to remove Nashorn warning (P4) JDK-8187960: Should document com.sun.management.jmxremote.rmi.port in properties table (P4) JDK-8211381: Update The Kerberos 5 GSS-API Mechanism page in security guide (P4) JDK-8162956: Use keytool -cacerts in security guides docs/hotspot: (P4) JDK-8212915: Update documentation after -XX:+AggressiveOpts removal docs/tools: (P3) JDK-8215880: Add -groupname to keytool tooldoc (P3) JDK-8217478: Doc changes in Jhsdb page (P3) JDK-8217481: Doc changes in Jinfo page (P3) JDK-8217483: Doc changes in Jstack page (P3) JDK-8217482: Doc changes Jmap in page (P3) JDK-8200467: Document various tools' new --enable-preview option (P3) JDK-8214416: Update jdeps tool reference guide (P4) JDK-8204582: Extra spaces in jlink documentation make it incorrect. globalization/translation: (P2) JDK-8218411: JDK 12 L10n resource file update msg drop 20 (P3) JDK-8215994: JDK 12 l10n resource file update - msg drop 10 (P4) JDK-8216590: [l10n][ja]Typo in javac_ja.properties hotspot: (P2) JDK-8213411: JDK-8209189 incorrect for Big Endian (JVM crashes) (P3) JDK-8209433: [s390] Fix build which was broken by 8208672 (Enable -Wreorder) (P3) JDK-8213414: Fix incorrect copy constructors in hotspot (P3) JDK-8208183: update HSDIS plugin license to UPL (P4) JDK-8209996: [PPC64] Fix JFR profiling. (P4) JDK-8211333: AArch64: Fix another build failure after JDK-8211029 (P4) JDK-8205619: Bump maximum recognized class file version to 56 for JDK 12 (P4) JDK-8210035: Fix copyrights for files created for the HeapMonitor work (P4) JDK-8209093: JEP 340: One AArch64 Port, Not Two (P4) JDK-8206183: Possible construct EMPTY_STACK and allocation stack, etc. on first use. hotspot/compiler: (P1) JDK-8217359: C2 compiler triggers SIGSEGV after transformation in ConvI2LNode::Ideal (P1) JDK-8213565: Crash in DependencyContext::remove_dependent_nmethod (P1) JDK-8214556: Crash in DependencyContext::remove_dependent_nmethod still happens (P1) JDK-8214206: Fix for JDK-8213419 is broken on 32-bit (P1) JDK-8219151: Illegal instruction exception on JDK 12 due to incorrect CPU feature bits (P1) JDK-8216050: Superword optimization fails with assert(0 <= i && i < _len) failed: illegal index (P1) JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash optimization using AVX instructions) (P1) JDK-8215353: x86_32 build failures after JDK-8214751 (X86: Support for VNNI Instructions) (P2) JDK-8210284: "assert((av & 0x00000001) == 0) failed: unsupported V8" on Solaris 11.4 (P2) JDK-8213259: [AOT] AOTing java.base fails with "java.lang.AssertionError: no fingerprint for Ljdk/internal/event/Event" (P2) JDK-8214401: [AOT] crash in ClassLoaderData::is_alive() with AOTed jdk.base (P2) JDK-8217678: [AOT] jck Math/IncrementExact and Math/DecrementExact tests fail when test classes are AOTed (P2) JDK-8210434: [Graal] 8209301 prevents GitHub Graal from compiling with latest JDK (P2) JDK-8215375: [Graal] jck:vm/jvmti/Exception/excp001/excp00101 fails in Graal as JIT mode and -Xcomp mode (P2) JDK-8209624: [JVMCI] Invalidate nmethods instead of directly unloading them when the InstalledCode is dropped (P2) JDK-8210497: [PPC64] Vector registers not saved across safepoint (P2) JDK-8207247: AArch64: Enable Minimal and Client VM builds (P2) JDK-8215100: AArch64: fix compareTo intrinsic with four-character Latin/Unicode (P2) JDK-8215202: AArch64: jtreg test test/jdk/sun/nio/cs/FindEncoderBugs.java fails (P2) JDK-8217467: Access barriers are missing in C2 intrinsic for Base64 (P2) JDK-8211212: ARM: -Werror=switch build failure (P2) JDK-8214936: assert(_needs_refill == 0) failed: Forgot to handle a failed IC transition requiring IC stubs (P2) JDK-8213825: assert(false) failed: Non-balanced monitor enter/exit! Likely JNI locking (P2) JDK-8217230: assert(t == t_no_spec) failure in NodeHash::check_no_speculative_types() (P2) JDK-8210963: Build failures after "8210829: Modularize allocations in C2" (P2) JDK-8216135: C2 assert(!had_error) failed: bad dominance (P2) JDK-8209511: C2 asserts with UseSSE < 4 and AVX enabled: "Label was never bound to a location, but it was used as a jmp target' (P2) JDK-8215044: C2 crash in loopTransform.cpp with assert(cl->trip_count() > 0) failed: peeling a fully unrolled loop (P2) JDK-8208275: C2 crash in Node::add_req(Node*) (P2) JDK-8210390: C2 still crashes with "assert(mode == ControlAroundStripMined && use == sfpt) failed: missed a node" (P2) JDK-8215757: C2: PhaseIdealLoop::create_new_if_for_predicate() computes wrong IDOM (P2) JDK-8215265: C2: range check elimination may allow illegal out of bound access (P2) JDK-8216541: CompiledICHolders of VM locked unloaded nmethods are released too late (P2) JDK-8213588: compiler/graalunit/HotspotTest.java fails after 8213348 / 8211781 were pushed (P2) JDK-8211698: Crash in C2 compiled code during execution of double array heavy processing code (P2) JDK-8213464: Fix missing include after JDK-8212243 (P2) JDK-8213604: Fix missing includes after JDK-8212673 (P2) JDK-8209594: guarantee(this->is8bit(imm8)) failed: Short forward jump exceeds 8-bit offset (P2) JDK-8214257: IC cache not clean after cleaning assertion failure (P2) JDK-8213348: jdk.internal.vm.compiler.management service providers missing in module descriptor (P2) JDK-8212609: Minimal VM build failure after JDK-8210498 (nmethod entry barriers) (P2) JDK-8211375: Minimal VM build failures after JDK-8211251 (Default mask register for avx512 instructions) (P2) JDK-8215888: Register to register spill may use AVX 512 move instruction on unsupported platform. (P2) JDK-8213486: SIGSEGV in CompiledMethod::cleanup_inline_caches_impl with AOT (P2) JDK-8213596: test failure with Graal when security manager and policy file are used (P2) JDK-8215708: ZGC: Add missing LoadBarrierNode::size_of() (P2) JDK-8215755: ZGC: split_barrier_thru_phi: check number of inputs of phi (P2) JDK-8211451: ~2.5% regression on compression benchmark starting with 12-b11 (P3) JDK-8214857: "bad trailing membar" assert failure at memnode.cpp:3220 (P3) JDK-8211740: [AOT] -XX:AOTLibrary doesn't accept windows path (P3) JDK-8209574: [AOT] breakpoint events are generated in different threads does not meet expected count when testcase vm/jvmti/Breakpoint/brkp001/brkp00102/brkp00102.html is executed (P3) JDK-8206963: [AOT] bug with multiple class loaders (P3) JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when JVMTI walks AOT frames (P3) JDK-8215313: [AOT] java/lang/String/Split.java fails with AOTed java.base (P3) JDK-8210220: [AOT] jdwp test cases are failing with error # ERROR: TEST FAILED: Cought IOException while receiving event packet: # ERROR: java.net.SocketTimeoutException: Read timed out (P3) JDK-8196568: [Graal] LongMulOverflowTest.java fails with "runTestOverflow() did not overflow" (P3) JDK-8216151: [Graal] Module jdk.internal.vm.compiler.management has not been granted accessClassInPackage.org.graalvm.compiler.debug (P3) JDK-8215133: AARCH64: disable Math.log intrinsic publishing (P3) JDK-8211320: AArch64: unsafe.compareAndSetByte() and unsafe.compareAndSetShort() c2 intrinsics broken with negative expected value (P3) JDK-8214961: AARCH64: wrong encoding for exclusive and atomic load/stores (P3) JDK-8212779: ADL Parser does not check allocation return values in all cases (P3) JDK-8209544: AES encrypt performance regression in jdk11b11 (P3) JDK-8212989: Allow CompiledMethod ExceptionCache have unloaded klasses (P3) JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java fails on ARM (P3) JDK-8210466: ARM: Modularize allocations in assembler (P3) JDK-8209639: assert failure in coalesce.cpp: attempted to spill a non-spillable item (P3) JDK-8210392: assert(Compile::current()->live_nodes() < Compile::current()->max_node_limit()) failed: Live Node limit exceeded limit (P3) JDK-8214862: assert(proj != __null) at compile.cpp:3251 (P3) JDK-8214025: assert(t->singleton()) failed: must be a constant when ScavengeRootsInCode < 2 (P3) JDK-8211231: BarrierSetC1::generate_referent_check() confuses register allocator (P3) JDK-8209651: better TLS poll for x64 C2 (P3) JDK-8209833: C2 compilation fails with "assert(ex_map->jvms()->same_calls_as(_exceptions->jvms())) failed: all collected exceptions must come from the same place" (P3) JDK-8210387: C2 compilation fails with "assert(node->_last_del == _last) failed: must have deleted the edge just produced" (P3) JDK-8209439: C2 library_call can potentially ignore Math.pow intrinsic or use null pointer (P3) JDK-8213419: C2 may hang in MulLNode::Ideal()/MulINode::Ideal() with gcc 8.2.1 (P3) JDK-8207965: C2-only debug build fails (P3) JDK-8214344: C2: assert(con.basic_type() != T_ILLEGAL) failed: elembt=byte; loadbt=void; unsigned=0 (P3) JDK-8210389: C2: assert(n->outcnt() != 0 || C->top() == n || n->is_Proj()) failed: No dead instructions after post-alloc (P3) JDK-8216427: ciMethodData::load_extra_data() does not always unpack the last entry (P3) JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize) doesn't work with 1GB LargePages (P3) JDK-8211332: code_size2 (defined in stub_routines_x86.hpp) is too small on new Skylake CPUs (P3) JDK-8210803: Compilation failure in codeBlob.cpp for Windows 32-bit (P3) JDK-8212610: Fix handling of memory in PhaseIdealLoop::clone_loop_predicates() (P3) JDK-8211232: GraphKit::make_runtime_call() sometimes attaches wrong memory state to call (P3) JDK-8211929: hotspot/share/opto/parse2.cpp compile error with gcc 7.3.1 (P3) JDK-8215500: ICRefillVerifierMark does not set the provided verfier as current (P3) JDK-8215205: javaVFrame much slower than vframeStream (P3) JDK-8215319: jck lang/INTF/intf049/intf04901 fails in Graal as JIT mode with -Xcomp and AOTed Graal (P3) JDK-8208463: jdk.internal.vm.compiler's module-info.java.extra contains duplicated provides of the same service interface (P3) JDK-8210853: JIT: C2 doesn't skip post barrier for new allocated objects (P3) JDK-8212673: jtreg/applications/runthese/RunThese30M.java fails in C2 with "assert(!had_error) failed: bad dominance" (P3) JDK-8205574: Loop predication "assert(f <= 1 && f >= 0) failed Incorrect frequency" (P3) JDK-8211233: MemBarNode::trailing_membar() and MemBarNode::leading_membar() need to handle dying subgraphs better (P3) JDK-8206931: Misleading "COMPILE SKIPPED: invalid non-klass dependency" compile log (P3) JDK-8216549: Mismatched unsafe access to non escaping object fails (P3) JDK-8212603: Need to step over GC barriers in Node::eqv_uncast() (P3) JDK-8215144: PPC64: Wrong assertion "illegal object size" (P3) JDK-8150552: Remove -XX:+AggressiveOpts (P3) JDK-8217043: Shenandoah: SIGSEGV in Type::meet_helper() at barrier expansion time (P3) JDK-8216482: Shenandoah: typo in ShenandoahBarrierSetC2::clone_barrier_at_expansion() causes failed compilations (P3) JDK-8217042: Shenandoah: write barrier on backedge of strip mined loop causes c2 crash at expansion time (P3) JDK-8209950: SIGBUS in CodeHeapState::print_names() (P3) JDK-8216314: SIGILL in CodeHeapState::print_names() (P3) JDK-8211168: Solaris-X64 build fails due to "Error: nreg hides the same name in an outer scope." (P3) JDK-8214189: test/hotspot/jtreg/compiler/intrinsics/mathexact/MulExactLConstantTest.java fails on Windows x64 when run with -XX:-TieredCompilation (P3) JDK-8177899: Tests fail due to code cache exhaustion on machines with many cores (P3) JDK-8211061: Tests fail with assert(VM_Version::supports_sse4_1()) on ThreadRipper CPU (P3) JDK-8215555: TieredCompilation C2 threads can excessively block handshakes (P3) JDK-8210764: Update avx512 implementation (P3) JDK-8206992: Update Graal (P3) JDK-8213538: VM crashes when MaxVectorSize is set to 0, 1 or 2 (P3) JDK-8211272: x86_32 build failures after JDK-8210764 (Update avx512 implementation) (P4) JDK-8187078: -XX:+VerifyOops finds numerous problems when running JPRT (P4) JDK-8208686: [AOT] JVMTI ResourceExhausted event repeated for same allocation (P4) JDK-8210588: [Graal] 5% regression on fft benchmark starting with 12-b8 (P4) JDK-8202533: [Graal] Implement StringUTF16.compress & StringLatin1.inflate (P4) JDK-8213203: [JVMCI] adopt formatting changes from jvmci 8 (P4) JDK-8213907: [JVMCI] avoid Class.getDeclared* methods when converting JVMCI objects to reflection objects (P4) JDK-8191339: [JVMCI] BigInteger compiler intrinsics on Graal (P4) JDK-8212934: [JVMCI] do not propagate resolution error in HotSpotResolvedJavaFieldImpl.getType (P4) JDK-8209535: [JVMCI] Do not swallow NoClassDefFoundError when converting JVMCI methods and fields to reflection objects. (P4) JDK-8210066: [JVMCI] iterateFrames uses wrong GrowableArray API for appending (P4) JDK-8209136: [JVMCI] Make sure volatile fields are read as volatile during constant reflection. (P4) JDK-8213347: [JVMCI] remove use of reflection in JVMCI (P4) JDK-8212817: [JVMCI] ResolvedJavaMethod.isInVirtualMethodTable throws InternalError (P4) JDK-8212956: [JVMCI] SpeculationReason should maintain identity (P4) JDK-8211145: [ppc] [s390]: Build fails due to -Werror=switch (introduced with JDK-8211029) (P4) JDK-8213196: [ppc] [s390]: prepare code for gcc7.3.1 warning (int-in-bool-context) (P4) JDK-8210319: [s390]: Use of shift operators not covered by cpp standard (P4) JDK-8198294: AARCH64 - Set flags' optimal defaults for Cavium Thunder X2 CPU (P4) JDK-8209783: AArch64: Combine Multiply and Neg operations in C2 (P4) JDK-8209835: Aarch64: elide barriers on all volatile operations (P4) JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction (P4) JDK-8210413: AArch64: Optimize div/rem by constant in C1 (P4) JDK-8206895: aarch64: rework error-prone cmp instuction (P4) JDK-8205421: AARCH64: StubCodeMark should be placed after alignment (P4) JDK-8213134: AArch64: vector shift failed with MaxVectorSize=8 (P4) JDK-8211170: AArch64: Warnings in C1 and template interpreter (P4) JDK-8215322: add @file support to jaotc (P4) JDK-8210972: Add comment text to C1 patching code (P4) JDK-8214908: add ctw tests for jdk.jfr and jdk.management.jfr modules (P4) JDK-8209691: Allow MemBar on single memory slice (P4) JDK-8213947: ARM32: failed check_simd should set UsePopCountInstruction to false (P4) JDK-8214128: ARM32: wrong stack alignment on Deoptimization::unpack_frames (P4) JDK-8209380: ARM: cleanup maybe-uninitialized and reorder compiler warnings (P4) JDK-8209697: ARM: Explicit barriers for C1/assembler (P4) JDK-8209695: ARM: Explicit barriers for interpreter (P4) JDK-8210465: ARM: Object equals abstraction for BarrierSetAssembler (P4) JDK-8212928: Assertion too strict in compiledVFrame::update_deferred_value on SPARC (P4) JDK-8207343: Automate vtable/itable stub size calculation (P4) JDK-8210215: C2 should optimize trichotomy calculations (P4) JDK-8214362: C2: gc interface entry point for split if (P4) JDK-8214526: Change CodeHeap State Analytics control from UL to Print* (P4) JDK-8212585: Clean up CompiledMethod::oops_reloc_begin() (P4) JDK-8209686: cleanup arguments to PhaseIdealLoop() constructor (P4) JDK-8213086: Compiler thread creation should be bounded by available space in memory and Code Cache (P4) JDK-8210885: Convert left over loads/stores to access api (P4) JDK-8213014: Crash in CompileBroker::make_thread due to OOM (P4) JDK-8211251: Default mask register for avx512 instructions (P4) JDK-8214434: Disabling ZOptimizeLoadBarriers hits assert (P4) JDK-8214376: Don't use memset to initialize array of Bundle in output.cpp (P4) JDK-8213745: Don't use memset to initialize array of RegMask in matcher.cpp (P4) JDK-8209668: Explicit barriers for C1/assembler (P4) JDK-8209667: Explicit barriers for C1/LIR (P4) JDK-8210187: Explicit barriers for C2 (P4) JDK-8214557: Filter out VM flags which don't affect AOT code generation (P4) JDK-8209023: fix 2 compiler tests to avoid JDK-8208690 (P4) JDK-8214523: Fix nmethod asserts for concurrent nmethod unloading (P4) JDK-8213795: Force explicit null check on patching placeholder offset (P4) JDK-8214172: GC interface entry points for loop opts (P4) JDK-8213371: GC/C2 abstraction and cleanup to handle custom offset for GC memory accesses (P4) JDK-8213746: GC/C2 abstraction for C2 matcher (P4) JDK-8213489: GC/C2 abstraction for Compile::final_graph_reshaping() (P4) JDK-8213615: GC/C2 abstraction for escape analysis (P4) JDK-8214057: GC/C2 abstraction for Node::has_special_unique_user() (P4) JDK-8214055: GC/C2 abstraction for phaseX (P4) JDK-8209825: guarantee(false) failed: wrong number of expression stack elements during deopt (P4) JDK-8213381: Hook to allow GC to inject Node::Ideal() calls (P4) JDK-8191006: hsdis disassembler plugin does not compile with binutils 2.29+ (P4) JDK-8209684: Intrinsics that assume some input non null should use GraphKit::must_be_not_null() (P4) JDK-8212070: Introduce diagnostic flag to abort VM on failed JIT compilation (P4) JDK-8208582: Introduce native oop barriers in C1 for OopHandle (P4) JDK-8208601: Introduce native oop barriers in C2 for OopHandle (P4) JDK-8213779: Loop opts anti dependent store detection should ignore uncommon trap calls (P4) JDK-8210355: Minimal and Zero non-PCH builds fail after JDK-8207343 (Automate vtable/itable stub size calculation) (P4) JDK-8215551: Missing case label in nmethod::reloc_string_for() (P4) JDK-8214004: Missing space between compiler thread name and task info in hs_err (P4) JDK-8213479: Missing x86_64.ad patterns for 8-bit logical operators with destination in memory (P4) JDK-8210829: Modularize allocations in C2 (P4) JDK-8212243: More gc interface tweaks for arraycopy (P4) JDK-8213384: Move G1/C2 barrier verification into G1BarrierSetC2 (P4) JDK-8214338: Move IC stub refilling out of IC cache transitions (P4) JDK-8210498: nmethod entry barriers (P4) JDK-8212706: nmethod jvmci_installed_code_name need to be XML escaped (P4) JDK-8210381: Obsolete EmitSync (P4) JDK-8211034: OnStackReplacePercentage option checking has bugs (P4) JDK-8214074: Optimize Ghash using AVX instructions (P4) JDK-8210152: Optimize integer divisible by power-of-2 check (P4) JDK-8214451: PPC64/s390: Clean up unused CRC32 prototype and function (P4) JDK-8214205: PPC64: Add instructions for counting trailing zeros (P4) JDK-8213754: PPC64: Add Intrinsics for isDigit/isLowerCase/isUpperCase/isWhitespace (P4) JDK-8211908: PPC64: Enable SuperWordLoopUnrollAnalysis by default (P4) JDK-8208171: PPC64: Enrich SLP support (P4) JDK-8210320: PPC64: Fix uninitialized variable in C1 LIR assembler code (P4) JDK-8215262: PPC64: FMA Vectorization on PPC64 (P4) JDK-8210660: PPC64: Mapping floating point registers to vsx registers in ppc.ad (P4) JDK-8212681: Refactor IC locking to use a fine grained CompiledICLocker (P4) JDK-8214027: Reinstate testB_mem_imm pattern in x86_64.ad (P4) JDK-8210752: Remaining explicit barriers for C2 (P4) JDK-8210676: Remove some unused Label variables (P4) JDK-8213469: Remove/fix leftovers from JDK-8213384: Move G1/C2 barrier verification into G1BarrierSetC2 (P4) JDK-8209186: Rename SimpleThresholdPolicy to TieredThresholdPolicy (P4) JDK-8213473: Replace testB_mem_imm matcher with testUB_mem_imm (P4) JDK-8214773: Replace use of thread unsafe strtok (P4) JDK-8209588: SIGSEGV in MethodArityHistogram() with -XX:+CountCompiledCalls (P4) JDK-8212611: Small collection of simple changes from shenandoah (P4) JDK-8209420: Track membars for volatile accesses so they can be properly optimized (P4) JDK-8210887: Tweak C2 gc api for arraycopy (P4) JDK-8211219: Type inconsistency in LIRGenerator::atomic_cmpxchg(..) (P4) JDK-8214059: Undefined behaviour in ADLC (P4) JDK-8212996: Use AS_NO_KEEPALIVE when accessing dead java.lang.invoke.CallSites during nmethod unloading (P4) JDK-8215206: VtableStubs::find_stub is not appropriately protected by VtableStubs_lock (P4) JDK-8214444: Wrong strncat limits in dfa.cpp (P4) JDK-8214751: X86: Support for VNNI Instructions (P4) JDK-8212616: x86_32 build failures after JDK-8210498 (nmethod entry barriers) (P4) JDK-8210357: Zero builds fail after JDK-8207343 (Automate vtable/itable stub size calculation) (P4) JDK-8214541: ZGC: Refactoring from JDK-8214172 may leave PhaseIterGVN::_delay_transform set (P5) JDK-8214912: LogCompilation: Show the comp level hotspot/gc: (P1) JDK-8215724: Epsilon: ArrayStoreExceptionTest.java fails; missing arraycopy check (P1) JDK-8208605: Fix for 8199868 breaks tier1 build (P1) JDK-8215005: Missing include of runtime/os.hpp in zError.cpp after JDK-8214944 breaks build without precompiled headers (P2) JDK-8209839: [Backout] Backout JDK-8206467 Refactor G1ParallelCleaningTask into shared (P2) JDK-8212896: AIX build breaks after 8212611 (P2) JDK-8215773: applications/kitchensink/Kitchensink.java crash with "assert(ZAddress::is_marked(addr)) failed: Should be marked" (P2) JDK-8215898: Build broken on 32-bit after JDK-8211425 (P2) JDK-8215897: Build broken on zero after JDK-8211425 (P2) JDK-8210164: building Minimal VM fails with error: comparison of unsigned expression < 0 is always false [-Werror=type-limits] (P2) JDK-8210265: Crash in HSpaceCounters::update_used() (P2) JDK-8209193: Fix aarch64-linux compilation after -Wreorder changes (P2) JDK-8210557: G1 next bitmap verification at the end of concurrent mark sometimes fails (P2) JDK-8214315: G1: fatal error: acquiring lock SATB_Q_FL_lock/1 out of order with lock tty_lock/0 (P2) JDK-8214118: HeapRegions marked as archive even if CDS mapping fails (P2) JDK-8215149: TestOptionsWithRangesDynamic.java fails after JDK-8215120 (P2) JDK-8214068: ZGC crashes with vmTestbase/nsk/jdi/ReferenceType/instances/instances004/TestDescription.java (P2) JDK-8217717: ZGC: Broken oop map in C1 load barrier stub (P2) JDK-8214484: ZGC: Exclude SA tests ClhsdbJhisto and TestHeapDumpFor* (P2) JDK-8212181: ZGC: Fix incorrect root iteration in ZHeapIterator (P2) JDK-8217309: ZGC: Fix ZNMethodTable corruption (P2) JDK-8215754: ZGC: nmethod is not unlinked from Method before rendezvous handshake (P2) JDK-8215487: ZGC: ZRuntimeWorkers incorrectly identify themselves as ZWorkers (P3) JDK-8209357: [PPC64] Fix build which was broken by 8208672 (Enable -Wreorder) (P3) JDK-8214125: [test] Fix comparison between pointer and integer in test_ptrQueueBufferAllocator.cpp (P3) JDK-8215889: assert(!_unloading) failed: This oop is not available to unloading class loader data with ZGC (P3) JDK-6735522: Bitmap - force inlining of find_next_one_bit() (P3) JDK-6735527: Bitmap - speed up searches (P3) JDK-8207200: Committed > max memory usage when getting MemoryUsage (P3) JDK-8212005: Epsilon elastic TLAB sizing may cause misalignment (P3) JDK-8207056: Epsilon GC to support object pinning (P3) JDK-8211150: G1 Full GC not purging code root memory and hence causing memory leak (P3) JDK-8213927: G1 ignores AlwaysPreTouch when UseTransparentHugePages is enabled (P3) JDK-8213307: G1 should clean up RMT with ClassUnloadingWithConcurrentMark (P3) JDK-8215548: G1PeriodicGCSystemLoadThreshold needs to be a double (P3) JDK-8211123: GC Metaspace printing after full gc (P3) JDK-8204529: gc/TestAllocateHeapAtMultiple.java fail with Agent 7 timed out (P3) JDK-8215491: ICStubInterface::finalize finds zombie nmethod with ZGC concurrent class unloading (P3) JDK-8213890: Implementation of JEP 344: Abortable Mixed Collections for G1 (P3) JDK-8190269: JEP 344: Abortable Mixed Collections for G1 (P3) JDK-8209495: NMethodSweeper::sweep_code_cache cause severe delays (P3) JDK-8209920: runtime/logging/RedefineClasses.java fail with OOME with ZGC (P3) JDK-8216490: Spammy periodic GC log message contains random time stamp with periodic gc disabled (P3) JDK-8211211: vmTestbase/metaspace/stressDictionary/StressDictionary.java timeout (P3) JDK-8214377: ZGC: Don't use memset to initialize array of ZForwardingTableEntry (P3) JDK-8216385: ZGC: Fix building without C2 (P3) JDK-8215547: ZGC: Fix incorrect match rule for loadBarrierWeakSlowRegNoVec (P4) JDK-8209758: 2 classes with same name G1PrintCollectionSetClosure cause crash when logging is enabled (P4) JDK-8215120: 32-bit build failures after JDK-8212657 (Promptly Return Unused Committed Memory from G1) (P4) JDK-8209942: [epsilon] range function for EpsilonTLABElasticity causes compiler warning (P4) JDK-8211432: [REDO] Handle JNIGlobalRefLocker.cpp (P4) JDK-8209841: [REDO] Refactor G1ParallelCleaningTask into shared (P4) JDK-8209118: Abstract SATBMarkQueueSet's ThreadLocalData access (P4) JDK-8210158: Accessorize JFR getEventWriter() intrinsics (P4) JDK-8196341: Add JFR events for parallel phases of G1 (P4) JDK-8212074: Add method to peek the remaining tasks in task queues (P4) JDK-8210986: Add OopStorage cleanup to ServiceThread (P4) JDK-8202286: Allocation of old generation of Java heap on alternate memory devices (P4) JDK-8211425: Allocation of old generation of java heap on alternate memory devices - G1 GC (P4) JDK-8211424: Allocation of old generation of java heap on alternate memory devices - Parallel GC (P4) JDK-8214231: Allow concurrent cleaning of TypeStackSlotEntries and ReturnTypeEntry (P4) JDK-8210857: Allow retiring TLABs and collecting statistics in parallel (P4) JDK-8214302: Allow safely calling is_unloading() on zombie nmethods (P4) JDK-8214056: Allow the GC to attach context information to CompiledMethod (P4) JDK-8210045: Allow using a subset of worker threads even when UseDynamicNumberOfGCThreads is false (P4) JDK-8204969: Asserts in objArrayKlass.cpp need to use _raw variants of obj_addr_at() (P4) JDK-8211853: Avoid additional duplicate work when a reference in the task queue has already been evacuated (P4) JDK-8212054: Boilerplate to bind oopDesc::equals_raw() to actual raw implementation (P4) JDK-8213373: Bulk MarkBitMap clearing methods (P4) JDK-8211926: Catastrophic size_t underflow in BitMap::*_large methods (P4) JDK-8210724: Change the verbosity threshold of logging for [oopstorage,ref] (P4) JDK-8210879: ClassLoaderStatsClosure does raw oop comparison (P4) JDK-8209062: Clean up G1MonitoringSupport (P4) JDK-8214278: Cleanup process_completed_threshold and related state (P4) JDK-8206457: Code paths from oop_iterate() must use barrier-free access (P4) JDK-8208670: Compiler changes to allow enabling -Wreorder (P4) JDK-8214791: Consistently name gc files containing VM operations (P4) JDK-8209852: Counters in StringCleaningTask should be type of size_t (P4) JDK-8213113: Dead code related to UseAdaptiveSizePolicy in ParNewGeneration (P4) JDK-8210892: Deprecate TLABStats (P4) JDK-8210716: Detailed GC logging request misses some (P4) JDK-8215097: Do not create NonJavaThreads before BarrierSet (P4) JDK-8214272: Don't use memset to initialize arrays of MemoryUsage in memoryManager.cpp (P4) JDK-8208672: Enable -Wreorder in make files for gcc, clang (P4) JDK-8212177: Epsilon alignment adjustments can overflow max TLAB size (P4) JDK-8205523: Explicit barriers for interpreter (P4) JDK-8071913: Filter out entries to free/uncommitted regions during iteration (P4) JDK-8204834: Fix confusing "allocate" naming in OopStorage (P4) JDK-8208246: flags duplications in vmTestbase_vm_g1classunloading tests (P4) JDK-6490394: G1: Allow heap shrinking / memory unmapping after reclaiming regions during Remark (P4) JDK-8213199: GC abstraction for Assembler::needs_explicit_null_check() (P4) JDK-8211955: GC abstraction for LAB reserve (P4) JDK-8211270: GC abstraction to get real object and headers size (P4) JDK-8208669: GC changes to allow enabling -Wreorder (P4) JDK-8212083: Handle remaining gc/lock native code and fix two strings (P4) JDK-8210192: Hsperf counter ParNew::CMS should be ParNew:CMS (P4) JDK-8212657: Implementation of JDK-8204089 Promptly Return Unused Committed Memory from G1 (P4) JDK-8214259: Implementation: JEP 189: Shenandoah: A Low-Pause-Time Garbage Collector (Experimental) (P4) JDK-8212753: Improve oopDesc::forward_to_atomic (P4) JDK-8212184: Incorrect oop ref strength used for referents in FinalReference (P4) JDK-8046179: JEP 189: Shenandoah: A Low-Pause-Time Garbage Collector (Experimental) (P4) JDK-8204089: JEP 346: Promptly Return Unused Committed Memory from G1 (P4) JDK-8210713: Let CollectedHeap::ensure_parsability() take care of TLAB statistics gathering (P4) JDK-8213755: Let nmethods be is_unloading() outside of safepoints (P4) JDK-8210330: Make CLD claiming allow multiple claim bits (P4) JDK-8209189: Make CompiledMethod::do_unloading more concurrent (P4) JDK-8211269: Make declaration of Allocation protected in MemAllocator (P4) JDK-8180193: Make marking bitmap code available to other GCs (P4) JDK-8211388: Make OtherRegionsTable independent of the region it is for (P4) JDK-8154343: Make SATB related code available to other GCs (P4) JDK-8210753: Make ThreadLocalAllocBuffer::resize() public (P4) JDK-8209345: Merge SATBMarkQueueFilter into SATBMarkQueueSet (P4) JDK-8212698: Minor g1 #include changes and memoryService.hpp copyright date update (P4) JDK-8213224: Move code related to GC threads calculation out of AdaptiveSizePolicy (P4) JDK-8209061: Move G1 serviceability functionality to G1MonitoringSupport (P4) JDK-8159440: Move marking of promoted objects during initial mark into the concurrent phase (P4) JDK-8072498: Multi-thread JNI weak reference processing (P4) JDK-8209843: Optimize oop scan closure closures wrt to reference processing in G1 (P4) JDK-8205921: Optimizing best-of-2 work stealing queue selection (P4) JDK-8210492: PLAB object promotion events report object sizes in words (P4) JDK-8204947: Port ShenandoahTaskTerminator to mainline and make it default (P4) JDK-8210236: Prepare ciReceiverTypeData::translate_receiver_data_from for concurrent class unloading (P4) JDK-8206407: Primitive atomic_cmpxchg_in_heap_at() in BarrierSet::Access needs to call non-oop raw method (P4) JDK-8209408: Primitive heap access for interpreter BarrierSetAssembler/arm32 (P4) JDK-8209396: PtrQueueSets are statically allocated (P4) JDK-8208498: Put archive regions into a first-class HeapRegionSet (P4) JDK-8210463: Recalculate_used() always sets time taken in G1GCPhaseTimes (P4) JDK-8206467: Refactor G1ParallelCleaningTask into shared (P4) JDK-8209346: Refactor SATBMarkQueue filter configuration (P4) JDK-8208611: Refactor SATBMarkQueue filtering to allow GC-specific filters (P4) JDK-8204970: Remaing object comparisons need to use oopDesc::equals() (P4) JDK-8209698: Remove "Pinned" from HeapRegionTraceType (P4) JDK-8213829: Remove circular dependency between g1CollectedHeap and g1ConcurrentMark (P4) JDK-8212025: Remove collector_present variable from ThreadHeapSampler (P4) JDK-8214144: Remove confusing locking_enqueue_completed_buffer (P4) JDK-8207953: Remove dead code in G1CopyingKeepAliveClosure (P4) JDK-8215043: Remove declaration of parallel_worker_threads (P4) JDK-8213997: Remove G1HRRSUseSparseTable flag (P4) JDK-8209700: Remove HeapRegionSetBase::RegionSetKind for a more flexible approach (P4) JDK-8213996: Remove one of the SparsePRT entry tables (P4) JDK-8209607: Remove stale comment for JNI mutexes (P4) JDK-8206272: Remove stray BarrierSetAssembler call (P4) JDK-8210467: Remove unused G1CollectedHeap::_max_heap_capacity (P4) JDK-8210711: Remove unused offset getters in ThreadLocalAllocBuffer (P4) JDK-8212595: Remove unused size_helper() in oop_oop_iterate* in instanceKlass.inline.hpp (P4) JDK-8214786: Remove unused ThreadLocalAllocBuffer::verify() (P4) JDK-8209801: Rename C1_WRITE_ACCESS and C1_READ_ACCESS decorators to ACCESS_READ and ACCESS_WRITE (P4) JDK-8210119: Rename SubTasksDone::is_task_claimed (P4) JDK-8210710: Rename ThreadLocalAllocBuffer::myThread() to thread() (P4) JDK-8193312: Rename VM_CGC_Operation to VM_G1Concurrent (P4) JDK-8211446: Replace oop_pc_follow_contents with oop_iterate and closure (P4) JDK-8211447: Replace oop_pc_update_pointers with oop_iterate and closure (P4) JDK-8201436: Replace oop_ps_push_contents with oop_iterate and closure (P4) JDK-8208671: Runtime, JFR, Serviceability changes to allow enabling -Wreorder (P4) JDK-8209347: SATBMarkQueue.cpp should not need jvm.h (P4) JDK-8213352: Separate BufferNode allocation from PtrQueueSet (P4) JDK-8156696: Simplify PtrQueueSet initialization (P4) JDK-8215220: Simplify Shenandoah task termination in aborted paths (P4) JDK-8209975: Some GCThreadLocalData not initialized (P4) JDK-8152724: Sum of eden before GC and current survivor capacity may be larger than heap size (P4) JDK-8199868: Support JNI critical functions in object pinning API (P4) JDK-8211718: Supporting multiple concurrent OopStorage iterators (P4) JDK-8200365: TestOptionsWithRanges.java of '-XX:TLABWasteTargetPercent=100' fails intermittently (P4) JDK-8212766: TestPromotionEventWithG1.java failed due to "RuntimeException: PLAB size is smaller than object size." (P4) JDK-8212911: Unify and micro-optimize handling of non-in-collection set references in oop closures (P4) JDK-8213142: Use RAII to set the scanning source in G1ScanEvacuatedObjClosure (P4) JDK-8211279: Verify missing object equals barriers (P4) JDK-8211735: Wrong heap mapper can be selected with UseLargePages on G1 (P4) JDK-8213711: Zero build broken after JDK-8213199 (GC abstraction for Assembler::needs_explicit_null_check()) (P4) JDK-8212748: ZGC: Add reentrant locking functionality (P4) JDK-8214476: ZGC: Build ZGC by default (P4) JDK-8209894: ZGC: Cap number of GC workers based on heap size (P4) JDK-8209831: ZGC: Clean up ZRelocationSetSelectorGroup::semi_sort() (P4) JDK-8209125: ZGC: Clean up ZServiceabilityCounters (P4) JDK-8209883: ZGC: Compile without C1 broken (P4) JDK-8214897: ZGC: Concurrent Class Unloading (P4) JDK-8210063: ZGC: Enable load barriers for IN_NATIVE runtime barriers (P4) JDK-8209127: ZGC: Improve error message when failing to map memory for mark stacks (P4) JDK-8210064: ZGC: Introduce ZConcurrentRootsIterator for scanning a subset of strong IN_NATIVE roots concurrently (P4) JDK-8210881: ZGC: Introduce ZRootsIteratorClosure (P4) JDK-8207756: ZGC: jstat should show CGC STW phases (P4) JDK-8213623: ZGC: Let heap iteration walk all roots (P4) JDK-8212921: ZGC: Move verification to after resurrection unblocked (P4) JDK-8209376: ZGC: Move ZMarkStackAllocator into a separate file (P4) JDK-8210883: ZGC: Parallel retire/resize/remap of TLABs (P4) JDK-8210884: ZGC: Remove insertion of filler objects (P4) JDK-8210065: ZGC: Remove mode for treating weaks as strong (P4) JDK-8210061: ZGC: Remove STW weak processor mode (P4) JDK-8209375: ZGC: Use dynamic base address for mark stack space (P4) JDK-8209126: ZGC: ZMarkStackAllocator::is_initialized() never called (P4) JDK-8210714: ZGC: ZWeakRootsIterator should no longer call reset/finish_dead_counter() (P5) JDK-8208297: Allow printing of taskqueue stats if compiled in in product builds (P5) JDK-8214202: DirtyCardQueueSet::get_completed_buffer should not clear _process_completed (P5) JDK-8206453: Taskqueue stats should count real steal attempts, not calls to GenericTaskQueueSet::steal (P5) JDK-8212974: Update RS Skipped cards uses wrong enum to register to phase hotspot/jfr: (P1) JDK-8214161: java.lang.IllegalAccessError: class jdk.internal.event.X509CertificateEvent (in module java.base) cannot access class jdk.jfr.internal.handlers.EventHandler (in module jdk.jfr) because module java.base does not read module jdk.jfr (P1) JDK-8214896: JFR Tool left files behind (P1) JDK-8214287: SpecJbb2005StressModule got uncaught exception (P2) JDK-8211239: Build fails without JFR: empty JFR events signatures mismatch (P2) JDK-8213172: CDS and JFR tests fail with assert(JdkJfrEvent::is(klass)) failed: invariant (P2) JDK-8205516: JFR tool (P2) JDK-8213421: Line number information for execution samples always 0 (P3) JDK-8209960: -Xlog:jfr* doesn't work with the JFR parser (P3) JDK-8207829: FlightRecorderMXBeanImpl is leaking the first classloader which calls it (P3) JDK-8215175: Inconsistencies in JFR event metadata (P3) JDK-8215237: jdk.jfr.Recording javadoc does not compile (P3) JDK-8213617: JFR should record the PID of the recorded process (P3) JDK-8203629: Produce events in the JDK without a dependency on jdk.jfr (P3) JDK-8215284: Reduce noise induced by periodic task getFileSize() (P3) JDK-8206919: s390: add missing info to vm_version_ext_s390 (P3) JDK-8165675: Trace event for thread park has incorrect unit for timeout (P3) JDK-8214750: Unnecessary

tags in jfr classes (P3) JDK-8212232: Wrong metadata for the configuration of the cutoff for old object sample events (P4) JDK-8211768: [s390] Implement JFR profiling. (P4) JDK-8213015: Inconsistent settings between JFR.configure and -XX:FlightRecorderOptions (P4) JDK-8210024: JFR calls virtual is_Java_thread from ~Thread() (P4) JDK-8212663: Remove conservative at_safepoint assert when JFR writes type sets during class unloading (P4) JDK-8202578: Revisit location for class unload events (P4) JDK-8215046: The ZGC JFR events should be marked as experimental hotspot/jvmti: (P1) JDK-8213814: build error in jtreg test jvmti/GetLocalVariable (P2) JDK-8215951: AArch64: jtreg test vmTestbase/nsk/jvmti/PopFrame/popframe005 segfaults (P2) JDK-8218025: disable pop_frame and force_early_return caps for Graal (P2) JDK-8212186: JVMTI lacks a few GC barriers/hooks (P3) JDK-8209361: [AOT] Unexpected number of references for JVMTI_HEAP_REFERENCE_CONSTANT_POOL [111-->111]: 0 (expected at least 1) (P3) JDK-8214572: [Graal] nsk/jvmti/unit/ForceEarlyReturn/earlyretbase should not suspend the thread when the top frame executes JVMCI code (P3) JDK-8211909: JDWP Transport Listener: dt_socket thread crash (P3) JDK-8209821: Make JVMTI GetClassLoaderClasses not walk CLDG (P3) JDK-8201603: MonitorContendedEnter failure in nsk/jvmti/scenarios/contention/TC02/tc02t001 (P3) JDK-8213525: new unit test GetLocalVariable/LocalVars is not stable (P3) JDK-8208186: SetHeapSamplingInterval handles 1 explicitly (P3) JDK-8080406: VM_GetOrSetLocal doesn't check local slot type against requested type (P3) JDK-8210926: vmTestbase/nsk/jvmti/scenarios/allocation/AP11/ap11t001/TestDescription.java failed with JVMTI_ERROR_INVALID_CLASS in CDS mode (P4) JDK-8209585: [Graal] vmTestbase/nsk/jvmti/scenarios/sampling tests fail with "Too small stack of resumed thread" (P4) JDK-8212939: Add space after if/while/for/switch and parenthesis (P4) JDK-8214502: Add space after/before {} in remaining vmTestbase tests (P4) JDK-8212822: Add space after/before {} in vmTestbase (P4) JDK-8214417: Add space after/before {} in vmTestbase/nsk/jvmti/[A-I] tests (P4) JDK-8212754: Build failure: undefined JvmtiSampledObjectAllocEventCollector::object_alloc_is_safe_to_sample (P4) JDK-8210385: Clean up JNI_ENV_ARG and factorize the macros for vmTestbase/jvmti[A-N] tests (P4) JDK-8210198: Clean up JNI_ENV_ARG for vmTestbase/jvmti/Get[A-F] tests (P4) JDK-8211950: Deprecate the check if a JVMTI collector is present assertion (P4) JDK-8209415: Fix JVMTI test failure HS202 (P4) JDK-8213246: Fix typo in vmTestbase failuire to failure (P4) JDK-8211335: Fix up spaces after ( and before ) in an if statement for vmTestbase/.*cpp (P4) JDK-8214531: HeapMonitorEventOnOffTest.java test fails with "Statistics should be null to begin with" (P4) JDK-8212931: HeapMonitorStatIntervalTest.java fails due average calculation (P4) JDK-8210775: JVM TI Spec missing copyright (P4) JDK-8213834: JVMTI ResourceExhausted should not be posted in CompilerThread (P4) JDK-8210235: JvmtiTrace::safe_get_current_thread_name is unsafe in debug builds (P4) JDK-8208352: Merge HeapMonitorTest and HeapMonitorGCTest code (P4) JDK-8214408: Migrate EventsOnOff to using the same allocateAndCheck method (P4) JDK-8214149: Move out assignments when not using NSK*VERIFY macros (P4) JDK-8215160: Normalize spaces for remaining vmTestbase tests (P4) JDK-8215161: Normalize spaces for vmTestbase/[a-j] (P4) JDK-8201513: nsk/jvmti/IterateThroughHeap/filter-* are broken (P4) JDK-8207364: nsk/jvmti/ResourceExhausted/resexhausted003 fails to start (P4) JDK-8211905: Remove multiple casts for EM06 file (P4) JDK-8215034: Remove old HOTSWAP conditionals (P4) JDK-8212148: Remove remaining NSK_CPP_STUBs (P4) JDK-8212771: Remove remaining spaces before/after () for vmTestbase (P4) JDK-8212535: Remove spaces before/after () for vmTestbase/[a-j]* (P4) JDK-8212770: Remove spaces before/after () for vmTestbase/jvmti/[s-u] (P4) JDK-8212884: Remove the assignments in ifs for vmTestbase/[a-s] (P4) JDK-8212082: Remove the NSK_CPP_STUB macros for remaining vmTestbase/jvmti/[sS]* (P4) JDK-8211261: Remove the NSK_CPP_STUB macros from vmTestbase for jvmti/[A-G]* (P4) JDK-8211131: Remove the NSK_CPP_STUB macros from vmTestbase for jvmti/[G-I]* (P4) JDK-8211782: Remove the NSK_CPP_STUB macros from vmTestbase for jvmti/[I-S]* (P4) JDK-8211801: Remove the NSK_CPP_STUB macros from vmTestbase for jvmti/scenarios/[A-E] (P4) JDK-8211899: Remove the NSK_CPP_STUB macros from vmTestbase for jvmti/scenarios/[E-M] (P4) JDK-8211036: Remove the NSK_STUB macros from vmTestbase for non jvmti (P4) JDK-8211980: Remove ThreadHeapSampler enable/disable/enabled methods (P4) JDK-8208303: Track JNI failures and fail tests (P4) JDK-8210486: Unused code in check_nest_attributes function (P4) JDK-8203356: VM Object Allocation Collector can infinite recurse (P4) JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/ap10t001/TestDescription.java failed with ObjectFree: GetCurrentThreadCpuTimerInfo returned unexpected error code hotspot/runtime: (P1) JDK-8215374: 32-bit build failures after JDK-8181143 (Introduce diagnostic flag to abort VM on too long VM operations) (P1) JDK-8213487: [BACKOUT] 8213414 Fix incorrect copy constructors in hotspot (P1) JDK-8209378: Fix Minimal VM after JDK-8208677 Move inner metaspace cleaning out of class unloading (P2) JDK-8211064: [AArch64] Interpreter and c1 don't correctly handle jboolean results in native calls (P2) JDK-8213211: [BACKOUT] Allow Klass::_subklass and _next_sibling to have unloaded classes (P2) JDK-8213209: [REDO] Allow Klass::_subklass and _next_sibling to have unloaded classes (P2) JDK-8213236: A partial removed/deleted JavaThread cannot transition (P2) JDK-8210461: AArch64: Math.cos intrinsic gives incorrect results (P2) JDK-8211956: AppCDS crashes for some uses with JRuby (P2) JDK-8209622: applications/kitchensink/Kitchensink.java failed with Kitchensink failed with exit code = 138 (P2) JDK-8215195: Bad HTML/Accessibility in jni/functions.html (P2) JDK-8215575: C2 crash: assert(get_instanceKlass()->is_loaded()) failed: must be at least loaded (P2) JDK-8213898: CDS dumping of springboot asserts in G1ArchiveAllocator::alloc_new_region (P2) JDK-8213574: Deadlock in string table expansion when dumping lots of CDS classes (P2) JDK-8211328: Different declaration and definition of ClassLoaderData::classes_do() leads to build failures (P2) JDK-8203466: intermittent crash at jdk.internal.misc.Unsafe::getObjectVolatile (native) (P2) JDK-8213148: JDK build fails because of missing #includes (P2) JDK-8215397: jsig.c missing classpath exception (P2) JDK-8205946: JVM crash after call to ClassLoader::setup_bootstrap_search_path() (P2) JDK-8211065: Private method check in linkResolver is incorrect (P2) JDK-8210523: runtime/appcds/cacheObject/DifferentHeapSizes.java crash (P2) JDK-8210422: runtime/modules/ModuleStress/ExportModuleStressTest.java - assertion failed: address not aligned: 0x00000008baadbabe (P2) JDK-8207832: serviceability/sa/ClhsdbCDSCore.java failed with java.lang.Error: Couldn't find core file location in: (P2) JDK-8207924: serviceability/sa/TestUniverse.java#id0 intermittently fails with assert(get_instanceKlass()->is_loaded()) failed: must be at least loaded (P2) JDK-8205965: SIGSEGV on write to NativeCallStack::EMPTY_STACK (P2) JDK-8213231: ThreadSnapshot::_threadObj can become stale (P2) JDK-8212205: VM asserts after CDS archive has been unmapped (P3) JDK-8211844: [aix] ProcessBuilder: Piping between created processes does not work. (P3) JDK-8207202: [Graal] compiler/graalunit/CoreTest.java fails (P3) JDK-8216376: [PPC64] Possibly unreliable stack frame resizing in template interpreter (P3) JDK-8204294: [REDO] - JVMFlag::printError missing ATTRIBUTE_PRINTF (P3) JDK-8215342: [Zero] Build fails after JDK-8200613 (P3) JDK-8215879: Aarch64: ReservedStackAccess may leave stack guard in inconsistent state (P3) JDK-8209586: AARCH64: SymbolTable changes throw assert on aarch64 (P3) JDK-8207778: Add locking to ModuleEntry and PackageEntry tables (P3) JDK-8210964: add more ld preloading info to hs_error file on Linux (P3) JDK-8213092: Add more runtime locks for concurrent class unloading (P3) JDK-8211326: add OS user related information to hs_err file (P3) JDK-8202201: All oop stores in the x64 interpreter are treated as volatile when using G1 (P3) JDK-8212958: Allow Klass::_subklass and _next_sibling to have unloaded classes (P3) JDK-8215395: Allow null oops in Dictionary and JNIHandle verification (P3) JDK-8185145: AppCDS custom loader support on Mac OS X (P3) JDK-8213563: appcds/sharedStrings/SharedStringsStress.java fails with 'GC triggered before VM initialization completed' error (P3) JDK-8202035: Archive the set of ModuleDescriptor and ModuleReference objects for observable system modules with unnamed initial module (P3) JDK-8210289: ArchivedKlassSubGraphInfoRecord is incomplete (P3) JDK-8213845: ARM32: Interpreter doesn't call result handler after native calls (P3) JDK-8212200: assert(on_stack()) failed when shared java.lang.object is redefined by JVMTI agent (P3) JDK-8213250: CDS archive creation aborts due to metaspace object allocation failure (P3) JDK-8214388: CDS dumping fails with java heap fragmentation (P3) JDK-8209385: CDS runtime classpath checking is too strict when only classes from the system modules are archived (P3) JDK-8211394: CHECK_ must be used in the rhs of an assignment statement within a block (P3) JDK-8210559: ClassLoaderData Symbols can leak (P3) JDK-8213751: ClassLoaderDataGraph::cld_do() should sometimes require CLDG_lock (P3) JDK-8211287: ClassPathTests.java fails due to "Unable to map MiscData shared space at required address." (P3) JDK-8209598: Clean up how messages are printed when CDS aborts start-up (P3) JDK-8214275: CondyRepeatFailedResolution asserts "Dynamic constant has no fixed basic type" (P3) JDK-8209647: constantPoolHandle::constantPoolHandle(ConstantPool*) when precompiled header is disabled (P3) JDK-8210592: Convert CDS-mode test sets in tier5 and tier6 to non-CDS-mode tests (P3) JDK-8192864: defmeth tests can hide failures (P3) JDK-8139876: Exclude hanging nsk/stress/stack from execution with deoptimization enabled (P3) JDK-8215583: Exclude runtime/handshake/HandshakeWalkSuspendExitTest.java (P3) JDK-8204591: Expire/remove the UseAppCDS option in JDK 12 (P3) JDK-8209541: Fix merge problem in SymbolTable::do_check_concurrent_work (P3) JDK-8209387: Follow ups to JDK-8195100 Use a low latency hashtable for SymbolTable (P3) JDK-8209139: globalCounter bootstrap issue (P3) JDK-8213560: gtests might hang (P3) JDK-8202951: Implementation of JEPJDK-8204247: Include default CDS (Class Data Sharing) archive in JDK binary (P3) JDK-8205611: Improve the wording of LinkageErrors to include module and class loader information (P3) JDK-8214827: Incorrect call ClassLoaders.toFileURL("jrt:/java.compiler") (P3) JDK-8202415: Incorrect time logged for monitor deflation (P3) JDK-8210043: Invalid assert(HeapBaseMinAddress > 0) in ReservedHeapSpace::initialize_compressed_heap (P3) JDK-8204247: JEP 341: Default CDS Archives (P3) JDK-8202835: jfr/event/os/TestSystemProcess.java fails on missing events (P3) JDK-8215451: JNI IsSameObject should not keep objects alive (P3) JDK-8215947: JVM crash with -XX:+DumpSharedSpaces (P3) JDK-8209301: JVM rename is_anonymous, host_klass to unsafe specific terminology ahead of Unsafe.defineAnonymousClass deprecation (P3) JDK-8210155: Lock ClassLoaderDataGraph (P3) JDK-8211208: make AllocateHeapAt an unsupported option on AIX (P3) JDK-8216271: Make AllocateOldGenAt an unsupported option on AIX. (P3) JDK-8208658: Make CDS archived heap regions usable even if compressed oop encoding has changed (P3) JDK-8213107: Make ClassLoaderDataGraph iterator skip unloaded CLDs (P3) JDK-8207359: Make SymbolTable increment_refcount disallow zero (P3) JDK-8209844: MemberNameLeak.java fails when ResolvedMethod entry is not removed (P3) JDK-8213713: Minor issues during MetaspaceShared::initialize_runtime_shared_and_meta_spaces (P3) JDK-8206009: Move CDS java heap object archiving code to heapShared.hpp and heapShared.cpp (P3) JDK-8208677: Move inner metaspace cleaning out of class unloading (P3) JDK-8202737: Obsolete AllowNonVirtualCalls option (P3) JDK-8188764: Obsolete AssumeMP and then remove all support for non-MP builds (P3) JDK-8198720: Obsolete PrintSafepointStatistics, PrintSafepointStatisticsTimeout and PrintSafepointStatisticsCount options (P3) JDK-8205417: Obsolete UnlinkSymbolsALot debugging option (P3) JDK-8210754: print_location is not reliable enough (printing register info) (P3) JDK-8211821: PrintStringTableStatistics crashes JVM (P3) JDK-8206471: Race with ConcurrentHashTable deleting items on insert with cleanup thread (P3) JDK-8209889: RedefineStress tests crash (P3) JDK-8209657: Refactor filemap.hpp to simplify integration with Serviceability Agent (P3) JDK-8208575: Remove Atomic::add/sub for short (P3) JDK-8198717: Remove compute_optional_offset (P3) JDK-8213137: Remove static initialization of monitor/mutex instances (P3) JDK-8203953: Rename SystemDictionary::load_shared_class(Symbol*, Handle, TRAPS) to load_shared_boot_class() (P3) JDK-8214944: replace strerror by os::strerror (P3) JDK-8213204: ReservedStackTest and ReservedStackTestCompiler tests failed with "This platform should be supported: amd64" (P3) JDK-8209564: runtime/appcds/CDSandJFR.java timeout on tier6 on sparc (P3) JDK-8208061: runtime/LoadClass/TestResize.java fails with "Load factor too high" when running in CDS mode (P3) JDK-8210300: runtime/MemberName/MemberNameLeak.java fails with RuntimeException (P3) JDK-8209736: runtime/RedefineTests/ModifyAnonymous.java fails with NullPointerException when running in CDS mode (P3) JDK-8213275: runtime/SharedArchiveFile/serviceability/ReplaceCriticalClasses.java fails with ClassNotFoundException: jdk.internal.vm.PostVMInitHook (P3) JDK-8212883: Setting a double manageable flag with jcmd/jinfo crashes the JVM (P3) JDK-8209389: SIGSEGV in WalkOopAndArchiveClosure::do_oop_work (P3) JDK-8208172: SIGSEGV when owner of invokedynamic bootstrap method throws an exception - Symbol::increment_refcount()+0x0 (P3) JDK-8209545: Simplify HeapShared::archive_module_graph_objects (P3) JDK-8213948: Solaris-X64 build fails with compact hashtable (P3) JDK-8213587: Speed up CDS dump time by using resizable hashtables (P3) JDK-8209645: Split ClassLoaderData and ClassLoaderDataGraph into separate files (P3) JDK-8207263: Store the Configuration for system modules into CDS archive (P3) JDK-8209138: Symbol constructor uses u1 as the element type of its name argument (P3) JDK-8205500: Test plan for JDK-8202035 Archive the set of ModuleDescriptor and ModuleReference objects for observable system modules (P3) JDK-8209971: TestOptionsWithRanges.java crashes in CDS mode with G1UpdateBufferSize=1 (P3) JDK-8205633: TestOptionsWithRanges.java of '-XX:TLABSize=2147483648' fails intermittently (P3) JDK-8212933: Thread-SMR: requesting a VM operation whilst holding a ThreadsListHandle can cause deadlocks (P3) JDK-8212173: Thread._stack_base/_stack_size initialized too late for new threads (P3) JDK-8209826: Undefined reference to os::write after JDK-8209657 (filemap.hpp cleanup) (P3) JDK-8079784: Unexpected IllegalAccessError when trying access InnerClasses attribute (P3) JDK-8210388: Use hash table to store archived subgraph_info records (P3) JDK-8206424: Use locking for cleaning ProtectionDomainTable (P3) JDK-8206423: Use locking for cleaning ResolvedMethodTable (P3) JDK-8206115: Use shared macros for JavaClasses::compute_offsets and MetaspaceShared::serialize_well_known_classes (P3) JDK-8190737: use unicode version of the canonicalize() function to handle long path on windows (P3) JDK-8214972: Uses of klass_holder() except GC need to apply GC barriers (P3) JDK-8214356: Verification of class metadata unloading takes a long time (P3) JDK-8210303: VM_HandshakeAllThreads fails assert with "failed: blocked and not walkable" (P3) JDK-8208697: vmTestbase/metaspace/stressHierarchy/stressHierarchy012/TestDescription.java fails with OutOfMemoryError: Metaspace (P3) JDK-8209447: vmTestbase/vm/mlvm/indy/func/jvmti/mergeCP_none2indy_b/TestDescription.java timed out (P4) JDK-8027434: "-XX:OnOutOfMemoryError" uses fork instead of vfork (P4) JDK-8212913: (Nested)ThreadsListHandleInErrorHandlingTest need to disable ShowRegistersOnAssert (P4) JDK-8210307: 8210246 broke NMT jtreg tests (P4) JDK-8210961: [aix] enhance list of environment variables reported in error log file on AIX (P4) JDK-8210314: [aix] NMT does not show "Safepoint" memory type (P4) JDK-8199567: [Nestmates] Cleanup instanceKlass.cpp (P4) JDK-8211387: [Zero] atomic_copy64: Use ldrexd for atomic reads on ARMv7 (P4) JDK-8212053: A few more missing object equals barriers (P4) JDK-8211845: A new switch to control verbosity of hs-err files (P4) JDK-8214332: Add a build flag for overriding default JNI library search path (P4) JDK-8212220: add code to verify results to metaspace/stressDictionary/StressDictionary.java (P4) JDK-8212612: Add documentation about Arguments::_exit_hook (P4) JDK-8214782: Add missing access barriers on CLD handle area (P4) JDK-8206022: Add test to check that the JVM accepts class files with version 56 (P4) JDK-8201375: Add the AllowArchivingWithJavaAgent diagnostic vm option to allow the use of the -javaagent option during CDS dumping (P4) JDK-8214784: Adjust Dictionary and JNIHandle verification (P4) JDK-8209850: Allow NamedThreads to use GlobalCounter critical sections (P4) JDK-8213033: Archive remaining primitive box caches (P4) JDK-8209120: Archive the Integer.IntegerCache (P4) JDK-8212617: ARM32 build failures after JDK-7041262 (VM_Version should be called instead of Abstract_VM_Version so that overriding works) (P4) JDK-8212682: Avoid holding Compile_lock when blocking for GC in ObjArrayKlass::allocate_objArray_klass() (P4) JDK-8212992: Change mirror accessor in Klass::verify_on() to use AS_NO_KEEPALIVE (P4) JDK-8205327: Clean up #if INCLUDE_CDS classLoaderExt.cpp and classLoaderExt.hpp (P4) JDK-8209958: Clean up duplicate basic array type statics in Universe (P4) JDK-8209087: Clean up runtime code that compares 'this' to NULL (P4) JDK-8210321: Create NO_KEEPALIVE CLD holder accessor (P4) JDK-8213708: Different #ifdef guards cause incorrect use of Monitor::check_block_state() (P4) JDK-8213826: Disable ARMv6 memory barriers on ARMv5 processors (P4) JDK-6516521: Doc: should document about the primordial thread attaching to the VM. (P4) JDK-8134538: Duplicate implementations of os::lasterror (P4) JDK-8214229: Enable ShowRegistersOnAssert by default (P4) JDK-8192899: EnableThreadSMRStatistics has some hot fields (P4) JDK-8209915: Fix license headers (P4) JDK-8211792: Fix misplaced BarrierSet forward declarations (P4) JDK-8211046: Forced data dependencies serve no purpose on x86 (P4) JDK-8204267: Generate comments in -XX:+PrintInterpreter to link to source code (P4) JDK-8212707: GlobalCounter padding is too optimistic (P4) JDK-8212827: GlobalCounter should support nested critical sections (P4) JDK-8211124: HotSpot vm_version.cpp should recognise updated VS2017 (P4) JDK-8212023: Implicit narrowing in Solaris/sparc initializer lists (P4) JDK-8215165: Improve -Xlog:class+preview message text (P4) JDK-8214807: Improve handling of very old class files (P4) JDK-8209976: Improve iteration over non-JavaThreads (P4) JDK-8206470: Incorrect use of os::lasterror in ClassListParser (P4) JDK-8213704: increase default timeout for vmTestbase/metaspace/stressDictionary/StressDictionary.java (P4) JDK-8211176: Initialize ObjectMonitor eagerly (P4) JDK-8211852: inspect stack during error reporting (P4) JDK-8181143: Introduce diagnostic flag to abort VM on too long VM operations (P4) JDK-8210168: JCK test .vm.classfmt.ins.code__002.code__00201m1.code__00201m1 hangs with -noverify (P4) JDK-8209323: JEP-JDK-8209093: SQE Test Plan for One AArch64 Port, Not Two (P4) JDK-8214522: Last runtime locking issues for concurrent class unloading (P4) JDK-8208399: Metadata methods print_(value_)on_maybe_null() compare 'this' to NULL (P4) JDK-8208604: Metadata::print_value_string() compares 'this' to NULL (P4) JDK-8207779: Method::is_valid_method() compares 'this' with NULL (P4) JDK-8213182: Minimal VM build failure after JDK-8212200 (assert when shared java.lang.Object is redefined by JVMTI agent) (P4) JDK-8208635: Minimal VM build is broken after JDK-8199868 (Support JNI critical functions in object pinning API) (P4) JDK-8211241: Missing obj equals in TemplateTable::fast_aldc (P4) JDK-8209911: More blob types in hs_err printout (P4) JDK-8213723: More Monitor/mutex initialization management (P4) JDK-8210861: Move assert to help diagnose rare RedefineStress crash (P4) JDK-8210856: Move InstanceKlass DependencyContext cleaning to SystemDictionary::do_unloading() (P4) JDK-8211714: Need to update vm_version.cpp to recognise VS2017 minor versions (P4) JDK-8214208: Nestmate package validation logging/exception should include classloader information (P4) JDK-8208499: NMT: Missing memory tag for Safepoint polling page (P4) JDK-8210246: NMTUtil::_memory_type_names should be in sync with MemoryType (P4) JDK-8211384: Obsolete -XX:+/-MonitorInUseLists option (P4) JDK-8209856: Obsolete error reporter (P4) JDK-8210513: Obsolete SyncFlags (P4) JDK-8210848: Obsolete SyncKnobs (P4) JDK-8210514: Obsolete SyncVerbose (P4) JDK-8213000: Obsolete the IgnoreUnverifiableClassesDuringDump vm option (P4) JDK-8213436: Obsolete UseMembar (P4) JDK-8206075: On x86, assert on unbound assembler Labels used as branch targets (P4) JDK-8213760: os::obsolete_option is obsolete and should be removed (P4) JDK-8202353: os::readdir should use readdir instead of readdir_r (P4) JDK-8017061: os_bsd.cpp contains code for UseSHM and UseHugeTLBFS (P4) JDK-8212937: Parent class loader may not have a referred ClassLoaderData instance when obtained in Klass::class_in_module_of_loader (P4) JDK-8204505: Performance: jweak references not suitable for robust cache architecture (P4) JDK-8212995: Place the Integer.IntegerCache and cached Integer objects in the closed archive heap region (P4) JDK-8212481: PPC64: Enable POWER9 CPU detection (P4) JDK-8210233: Prepare Klass::is_loader_alive() for concurrent class unloading (P4) JDK-8214707: Prevent GCC 8 from reporting error in ClassLoader::file_name_for_class_name() (P4) JDK-8024368: private methods are allocated vtable indices (P4) JDK-8213346: Re-implement shared dictionary using CompactHashtable (P4) JDK-8210864: Reduce the use of metaspaceShared.hpp (P4) JDK-8210875: Refactor CompactHashtable (P4) JDK-8209738: Remove ClassLoaderDataGraph::*oops_do functions (P4) JDK-8209792: Remove ClassLoaderDataGraph::keep_alive_cld_do (P4) JDK-8213438: Remove ClearResponsibleAtSTW (P4) JDK-8214029: Remove dead code BasicHashtable::bulk_free_entries (P4) JDK-8212774: Remove dead code touching Klass::_lower_dimension (P4) JDK-8211364: Remove expired flags (P4) JDK-8211296: Remove HotSpot deprecation warning suppression for Mac/clang (P4) JDK-8205548: Remove multi-release jar related vm code (P4) JDK-8207689: Remove perfCounter _load_instance_class_failCounter used by deleted flag UnsyncloadClass (P4) JDK-8208519: Remove rehashable hashtable (P4) JDK-8212642: Remove SystemDictionary::InitOption enum (P4) JDK-8211175: Remove temporary clock initialization duplication (P4) JDK-8213767: Remove the -Xconcurrentio flag and associated code (P4) JDK-8208699: remove unneeded imports from runtime tests (P4) JDK-8210470: Remove unused Verifier::verify() Verifier::Mode argument (P4) JDK-8214785: Remove unused WeakHandleType::vm_string (P4) JDK-8207011: Remove uses of the register storage class specifier (P4) JDK-8213992: Rename and make DieOnSafepointTimeout the diagnostic option (P4) JDK-8211403: Rename SafepointMechanism::poll(...) (P4) JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass (P4) JDK-8214850: Rename vm_operations.?pp files to vmOperations.?pp files (P4) JDK-8178712: ResourceMark may be missing inside initialize_[vi]table (P4) JDK-8213439: Run class initialization for boot loader classes with registered subgraph archiving entry field during CDS dump time (P4) JDK-8212207: runtime/InternalApi/ThreadCpuTimesDeadlock.java crashes with SEGV in pthread_getcpuclockid+0x0 (P4) JDK-8214840: runtime/NMT/MallocStressTest.java timed out (P4) JDK-8214181: safepoint header cleanup (P4) JDK-8212108: SafepointSynchronizer never ending counter (big enough) (P4) JDK-8164683: Solaris: JVM abuses thread preemption control (P4) JDK-8202171: Some oopDesc functions compare this with NULL (P4) JDK-8210889: Some service thread cleanups can be starved (P4) JDK-8208999: Some use of Klass* should be replaced by InstanceKlass* (P4) JDK-8209927: Split appcds/sharedStrings/IncompatibleOptions.java into several tests (P4) JDK-8213791: StringTable: Use get and insert (P4) JDK-8213893: StringTable_lock is unused (P4) JDK-8214310: SymbolTable: Use get and insert (P4) JDK-8208480: Test failure: assert(is_bound() || is_unused()) after JDK-8206075 in C1 (P4) JDK-8203911: Test runtime/modules/getModuleJNI/GetModule fails with -Xcheck:jni (P4) JDK-8150689: Thread dump report "waiting to re-lock in wait()" shows incorrectly (P4) JDK-8214726: Typo in HeapShared::check_closed_archive_heap_region_object (P4) JDK-8214728: Unnecessary InstanceKlass::cast at few places (P4) JDK-8195100: Use a low latency hashtable for SymbolTable (P4) JDK-8213410: UseCompressedOops requirement check fails fails on 32-bit system (P4) JDK-7041262: VM_Version should be called instead of Abstract_VM_Version so that overriding works (P4) JDK-8213383: Wrap up pthread_cond_wait into a loop to workaround potential spurious wakeups (P4) JDK-8211274: x86_32 build failures after JDK-8211029 (Have a common set of enabled warnings for all native libraries) (P4) JDK-8214787: Zero builds fail with "undefined JavaThread::thread_state()" (P5) JDK-8213592: Misaligned code in globals.hpp after 8211845 hotspot/svc: (P3) JDK-8201652: [TEST] rewrite com/sun/jdi serviceability shell tests to java version (P3) JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1 (P3) JDK-8209414: AArch64: method handle invocation does not respect JVMTI interp_only mode (P4) JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java (P4) JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect (P5) JDK-8021335: Missing synchronization when reading counters for live threads and peak thread count hotspot/svc-agent: (P2) JDK-8210836: Build fails with warn_unused_result in openjdk/src/jdk.hotspot.agent/linux/native/libsaproc/ps_core.c (P3) JDK-8214373: adjust usage of ReleaseLongArrayElements in MacosxDebuggerLocal (P3) JDK-8210948: Doc changes in Jstack, Jmap and similar tools (P3) JDK-8205534: Remove SymbolTable dependency from serviceability agent (P3) JDK-8202884: SA: Attach/detach might fail on Linux if debugee application create/destroy threads during attaching (P3) JDK-8214226: SA: Incorrect BCI and Line Number with jstack if the top frame is in the interpreter (P3) JDK-8200613: SA: jstack throws UnmappedAddressException with a CDS core file (P3) JDK-8204308: SA: serviceability/sa/TestInstanceKlassSize*.java fails when running in CDS mode (P4) JDK-8214499: SA should follow 8150689 (P4) JDK-8213323: sa/TestJmapCoreMetaspace.java and sa/TestJmapCore.java fail with ZGC (P4) JDK-8208091: SA: jhsdb jstack --mixed throws UnmappedAddressException on i686 hotspot/test: (P1) JDK-8211291: Backout JDK-8210842 Handle JNIGlobalRefLocker.cpp (P1) JDK-8210205: build fails on AIX in hotspot cpp tests (for example getstacktr001.cpp) (P2) JDK-8213337: windows-x64-slowdebug build is broken by 8177708 (P3) JDK-8209689: Compiler.isGraalEnabled should not check jvmci.Compiler property (P3) JDK-8208706: compiler/tiered/ConstantGettersTransitionsTest.java fails to compile (P3) JDK-8164546: Convert DirectivesParser_test to GTest (P3) JDK-8077965: Convert internal tests to unit test framework (P3) JDK-8207855: Make applications/jcstress invoke tests in batches (P3) JDK-8075327: Merge jdk and hotspot test libraries (P3) JDK-8208157: requires.VMProps throws NPE for missing properties in "release" file (P3) JDK-8208647: switch jtreg to 4.2b13 (P4) JDK-8218197: [failurehandler] parent processes shouldn't be killed till their children are handled (P4) JDK-8213718: [TEST] Wrong classname in vmTestbase/nsk/stress/except/except002 and except003 (P4) JDK-8213794: ARM32: disable TypeProfiling, CriticalJNINatives, Serviceablity tests for ARM32 (P4) JDK-8209547: Clean up JNI_ENV and JVMTI_ENV macros (P4) JDK-8210700: Clean up JNI_ENV_ARG and factorize the macros for vmTestbase/jvmti/unit tests (P4) JDK-8210593: Clean up JNI_ENV_ARG and factorize the macros for vmTestbase/jvmti[N-R] tests (P4) JDK-8210665: Clean up JNI_ENV_ARG and factorize the macros for vmTestbase/jvmti[R-U] tests (P4) JDK-8210429: Clean up JNI_ENV_ARG for vmTestbase/jvmti/Get[G-Z] tests (P4) JDK-8078541: Create hotspot unit test docs page (P4) JDK-8207791: Fix and re-enable perfmon testing in Kitchensink (P4) JDK-8210726: Fix up a few minor nits forgotten by JDK-8210665 (P4) JDK-8210842: Handle JNIGlobalRefLocker.cpp (P4) JDK-8210481: Remove #ifdef cplusplus from vmTestbase (P4) JDK-8213058: remove ExecuteInternalVMTests and VerboseInternalVMTests flags (P4) JDK-8210182: Remove macros for C compilation from vmTestBase but non jvmti (P4) JDK-8210689: Remove the multi-line old C style for string literals (P4) JDK-8210728: Remove the NSK_STUB macros from vmTestbase (P4) JDK-8209549: remove VMPropsExt from TEST.ROOT (P4) JDK-8209740: typo in test/lib/jtreg/SkippedException.java (P4) JDK-8214400: Update hotspot application/jcstress jtreg tests wrappers to use jcstress 0.5 (P4) JDK-8209611: use C++ compiler for hotspot tests (P4) JDK-8208655: use JTreg skipped status in hotspot tests (P4) JDK-8210107: vmTestbase/nsk/stress/network tests fail with Cannot assign requested address (Bind failed) infrastructure: (P3) JDK-8208524: IntelliJ support broken since 2018.2 (P4) JDK-8190985: .jcheck/conf files contain 'project=jdk10' (P4) JDK-8213591: running bin/idea.sh in Cygwin: generated project cannot be imported infrastructure/build: (P1) JDK-8213338: Reduce the number of generated make targets (P1) JDK-8213184: Revert change in jib-profiles.js from run-test-prebuilt to test-prebuilt (P2) JDK-8213736: Build fails with LOG=debug on F28 after JDK-8210958 (P2) JDK-8210519: build/releaseFile/CheckSource.java failed additional sources found (P2) JDK-8211724: Change mkdir -p to MakeDir macro where possible (P2) JDK-8211130: Change to Oracle Developer Studio 12.6 for building on Solaris at Oracle (P2) JDK-8211837: Creation of the default CDS Archive should depend on ENABLE_CDS (P2) JDK-8215030: Disable shenandoah in Oracle builds (P2) JDK-8211677: Java resource copy and clean should use MakeTargetDir macro (P2) JDK-8209760: merge error: restore ea in make/conf/jib-profiles.js (P2) JDK-8213005: Missing symbols in hs_err files on Windows after JDK-8212028 (P2) JDK-8215635: Pandoc check in Docs.gmk does not work on Windows (P2) JDK-8216021: RunTest.gmk might set concurrency level to 1 on Windows (P2) JDK-8212028: Use run-test makefile framework for testing in Oracle's Mach5 (P3) JDK-8182733: aarch64 build documentation misleading (P3) JDK-8210837: Add libXrandr-devel to the Linux devkits (P3) JDK-8214720: Add pandoc filter to improve html man page output (P3) JDK-8210723: Better information in configure for invalid Xcode (P3) JDK-8211879: Broken links in API overview (P3) JDK-8210750: Clean up compare.sh exceptions (P3) JDK-8210729: Clean up macosx static library handling (P3) JDK-8178317: Create man pages using pandoc from markdown sources (P3) JDK-8215356: Disable x86_32 Shenandoah build to avoid hotspot/tier1 failures (P3) JDK-8214741: docs/index.html has no title or copyright (P3) JDK-8167314: Enable the check to detect duplicate provides in in GenModuleInfoSource (P3) JDK-8212587: equals in MakeBase does not handle empty strings correctly (P3) JDK-8211057: Gensrc step CompileProperties generates unstable CompilerProperties output (P3) JDK-8211029: Have a common set of enabled warnings for all native libraries (P3) JDK-8210988: Improved handling of compiler warnings in the build (P3) JDK-8210931: JLI and launchers normalization and cleanup (P3) JDK-8214003: Limit default test jobs based on memory size (P3) JDK-8215304: Make target "docs-jdk-index" has unnecessary dependencies (P3) JDK-8214045: Missing explicit dependencies of build-microbenchmark cause intermittent build failure (P3) JDK-8210920: Native C++ tests are not using CXXFLAGS (P3) JDK-8213102: Oracle Unilinks are [301 Moved Permanently] to https://docs.oracle.com (P3) JDK-8215177: pandoc should use (P3) JDK-8215308: pandoc-html-manpage-filter.js does not work for [un]pack200 (P3) JDK-8200609: Proper fix for mapfile removal for libjsig (P3) JDK-8210731: PropertiesParser does not produce reproducible output (P3) JDK-8210704: Remove dead build tools hasher and jarreorder (P3) JDK-8210160: Remove deprecated configure arguments (P3) JDK-8210702: Remove dtrace mapfiles (P3) JDK-8210924: Remove PACKAGE_PATH (P3) JDK-8210919: Remove statically linked libjli on Windows (P3) JDK-8213237: Remove test-compile-commands from jib-profiles.js (P3) JDK-8210958: Rename "make run-test" to "make test" (P3) JDK-8180178: Restructure existing man pages according to JEP 299 (P3) JDK-8214534: Setting of THIS_FILE in the build is broken (P3) JDK-8209817: stack is executable when building with Clang on Linux (P3) JDK-8210705: Stop exporting all symbols on macosx (P3) JDK-8210949: Stop filtering out -xc99=%none for liblcms (P3) JDK-8210941: Stop filtering out -xregs=no%appl for libsunec (P3) JDK-8210944: Stop replacing -MD with -MT in libwindowsaccessbridge (P3) JDK-8210283: Support git as an SCM alternative in the build (P3) JDK-8213906: Update arm devkits with libXrandr headers (P3) JDK-8215129: Update build documentation with Xrandr (P3) JDK-8218465: Update name and links for JLS and JVMS (P3) JDK-8213339: Update precompiled.hpp with headers based on current frequency (P3) JDK-8212008: Use of TREAT_EXIT_CODE_1_AS_0 hide problems with jtreg Java (P3) JDK-8215400: Warn on usage of trampolines with gcc (P4) JDK-8214075: [BACKOUT] 8214007: Fix sun.awt.nativedebug on X11 platforms (P4) JDK-8210416: [linux] Poor StrictMath performance due to non-optimized compilation (P4) JDK-8210425: [x86] sharedRuntimeTrig/sharedRuntimeTrans compiled without optimization (P4) JDK-8213428: Add a no precompiled header Linux build to builds-tier1 and jdk-submit (P4) JDK-8210459: Add support for generating compile_commands.json (P4) JDK-8165440: Add Zero support for x86_64-linux-gnux32 target (P4) JDK-8211727: Adjust default concurrency settings for running tests on Sparc (P4) JDK-8210960: Allow --with-boot-jdk-jvmargs to work during configure (P4) JDK-8207849: Allow the addition of more number to the Java version string (P4) JDK-8208665: Amend cross-compilation docs with qemu-debootstrap recipe (P4) JDK-8214466: Append assembler flags on ARM targets (P4) JDK-8212110: Build of saproc.dll broken on Windows 32 bit after JDK-8210647 (P4) JDK-8213569: Bump minimum boot jdk to JDK 11 (P4) JDK-8212201: Classlist build tool should be built for the target JDK version (P4) JDK-8206950: Closed updates for removing javac -source/-target 6 (P4) JDK-8214780: Create pandoc package for Windows (P4) JDK-8210008: custom extension for make/SourceRevision.gmk (P4) JDK-8210962: Deprecate jdk-variant (P4) JDK-8211268: Disable unsupported GCs for Zero (P4) JDK-8214311: dtrace gensrc has missing dependencies (P4) JDK-8173263: Enable USDT probes in Oracle JDK in Linux (P4) JDK-8214710: Fix hg log in update_copyright_year.sh (P4) JDK-8202941: GenModuleInfoSource build tool does not detect missing semicolons (P4) JDK-8213187: Handle libwindowsaccessbridge need to access MSVCRT functions (P4) JDK-8213698: Improve devkit creation and add support for linux/ppc64/ppc64le/s390x (P4) JDK-8213515: Improve freetype detection on linux/ppc64/ppc64le/s390x (P4) JDK-8205621: Increment JDK version for JDK 12 (P4) JDK-8214062: JDK-8167368 Leftover: get_source.sh in build documentation (P4) JDK-8210761: libjsig is being compiled without optimization (P4) JDK-8210647: libsaproc is being compiled without optimization (P4) JDK-8212994: Links to Oracle websites should use https: (P4) JDK-8211037: Load jib jars dynamically from JibArtifactResolver (P4) JDK-8215239: Make deletes images/jdk/bin/java if something goes wrong (P4) JDK-8081858: make dist-clean does not delete all log files (P4) JDK-8207057: No debug info for assembler files (P4) JDK-8212004: Optional compile_commands.json field not compatible with older libclang (P4) JDK-8215131: Pandoc 2.3/build documentation fixes (P4) JDK-8211781: re-building fails after changing Graal sources (P4) JDK-8211350: Remove jprt support (P4) JDK-8208744: remove unneeded -DUSE_MMAP settings for JDK native libs builds (P4) JDK-8212877: Restore JTREG_VERBOSE value for mach5 testing (P4) JDK-8009683: Running regression tests with make (P4) JDK-8059019: sdp.conf.template should be copied on linux too (P4) JDK-8058538: Set default log level in configure (P4) JDK-8161478: Solaris mapfiles are all in the deprecated V1 format (P4) JDK-8207264: solaris-sparcv9-cmp-baseline fails (P4) JDK-8213227: Update jib src excludes to filter webrev and Jtreg directories (P4) JDK-8214718: Update missing copyright year in build system (P4) JDK-8214465: Upgrade arm-sflt minimum architecture to ARMv5TE for assembler (P4) JDK-8210703: vmStructs.cpp compiled with -O0 (P5) JDK-6657100: Rename sparcWorks to solstudio in HotSpot infrastructure/licensing: (P2) JDK-8213154: Update copyright headers of files in src tree that are missing Classpath exception infrastructure/release_eng: (P3) JDK-8210591: Verify default CDS archive is included in JDK RE bundle install/uninstall: (P2) JDK-8211012: [Linux] JDK 11, warning when uninstall rpm package "warning: %postun(jdk-11-2000:11-ga.x86_64) scriptlet failed, exit status 2 other-libs: (P3) JDK-8210318: idea.sh script doesn't work on Mac (P4) JDK-8210226: Add support for multiple project folders to idea.sh other-libs/other: (P3) JDK-8213480: update internal ASM version to 7.0 (P4) JDK-8210779: 8182404 and 8210732 haven't updated copyright years (P4) JDK-8209771: jdk.test.lib.Utils::runAndCheckException error (P4) JDK-8211171: move JarUtils to top-level testlibrary (P4) JDK-8210039: move OSInfo to top level testlibrary (P4) JDK-8211975: move testlibrary/jdk/testlibrary/OptimalCapacity.java to top-level library (P4) JDK-8182404: remove jdk.testlibrary.JDKToolFinder and JDKToolLauncher (P4) JDK-8210022: remove jdk.testlibrary.ProcessThread, TestThread and XRun (P4) JDK-8210112: remove jdk.testlibrary.ProcessTools (P4) JDK-8210732: remove jdk.testlibrary.Utils (P4) JDK-8210894: remove jdk/testlibrary/Asserts performance: (P3) JDK-8050952: JEP 230: Microbenchmark Suite (P4) JDK-8061281: Microbenchmark suite build support, directory layout and sample benchmarks (P4) JDK-8061282: Migrate jmh-jdk-microbenchmarks into the JDK performance/libraries: (P4) JDK-8215140: Port missing crypto JMH micros from jmh-jdk-microbenchmarks security-libs: (P4) JDK-8209304: Deprecate serialVersionUID fields in interfaces (P4) JDK-8206443: Update security libs manual test to cope with removal of javac -source/-target 6 (P5) JDK-8210786: Typo s/overriden/overridden/ in several places security-libs/java.security: (P2) JDK-8214513: A PKCS12 keystore from Java 8 using custom PBE parameters cannot be read in Java 11 (P2) JDK-8214583: AccessController.getContext may return wrong value after JDK-8212605 (P2) JDK-8210432: Add additional TeliaSonera root certificate (P2) JDK-8216280: Allow later Symantec Policy distrust date for two Apple SubCAs (P2) JDK-8207321: Merge error with 8199779 (P2) JDK-8191053: Provide a mechanism to make system's security manager immutable (P3) JDK-8195774: Add Entrust root certificates (P3) JDK-8076190: Customizing the generation of a PKCS12 keystore (P3) JDK-8212003: Deprecating the default keytool -keyalg value (P3) JDK-8148188: Enhance the security libraries to record events of interest (P3) JDK-7092821: java.security.Provider.getService() is synchronized and became scalability bottleneck (P3) JDK-8215694: keytool cannot generate RSASSA-PSS certificates (P3) JDK-8212867: Link to DRBG test vectors is redirected to a broken link (P3) JDK-8212605: Pure-Java implementation of AccessController.doPrivileged (P3) JDK-8203230: Remove cacerts.internal from Oracle JDK (P3) JDK-8195793: Remove GTE CyberTrust Global Root (P3) JDK-8211049: Second parameter of "initialize" method is not used (P3) JDK-6899533: SecureClassLoader and URLClassLoader have unnecessary check for createClassLoader permission (P3) JDK-8214096: sun.security.util.SignatureUtil passes null parameter, so JCE validation fails (P3) JDK-8213400: Support choosing group name in keytool keypair generation (P3) JDK-8214329: SwingMark SubMenus 9% regression in 12-b19 on Linux client (P3) JDK-8214532: Update RFC 2459 references in javadoc to RFC 5280 (P3) JDK-8214100: use of keystore probing results in unnecessary exception thrown (P3) JDK-8214568: Use {@systemProperty} for definitions of system properties (P4) JDK-8210395: Add doc to SecurityTools.java (P4) JDK-8214179: Add groupname info into keytool -list and -genkeypair output (P4) JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (P4) JDK-8209995: java.base does not need to export sun.security.ssl to java.security.jgss (P4) JDK-8201290: keytool importcert fails with CertificateParsingException if unknown certificate algorithms should be imported (P4) JDK-8211971: Move security/cacerts/VerifyCACerts.java and security/CheckBlacklistedCerts.java (P4) JDK-8209416: Refactoring GetPropertyAction calls in security libs (P4) JDK-8213952: Relax DNSName restriction as per RFC 1123 (P4) JDK-8208675: Remove legacy sun.security.key.serial.interop property (P4) JDK-8209024: Use SuppressWarnings on serialVersionUID fields in interfaces security-libs/javax.crypto: (P1) JDK-8210912: Build error in src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c after JDK-8029661 (P2) JDK-8205476: KeyAgreement#generateSecret is not reset for ECDH based algorithm (P3) JDK-8212669: Add note to Cipher javadoc about using full transformation and not relying on defaults (P3) JDK-8207775: Better management of CipherCore buffers (P3) JDK-8208583: Better management of internal KeyStore buffers (P3) JDK-8209862: CipherCore performance improvement (P3) JDK-8179098: Crypto AES/ECB encryption/decryption performance regression (introduced in jdk9b73) (P4) JDK-8209851: Algorithm name is compared via reference identity (P4) JDK-8201355: Avoid native memory allocation in sun.security.mscapi.PRNG.generateSeed (P4) JDK-8208648: ECC Field Arithmetic Enhancements (P4) JDK-8209129: Further improvements to cipher buffer management (P4) JDK-8208698: Improved ECC Implementation (P4) JDK-8210838: Override javax.crypto.Cipher.toString() (P4) JDK-8213009: Refactoring existing SunMSCAPI classes (P4) JDK-8214262: SunEC native code does not compile with debug on (P4) JDK-8213010: Supporting keys created with certmgr.exe (P4) JDK-8213363: X25519 private key PKCS#8 encoding/decoding is incorrect (P4) JDK-8201317: X25519/X448 code improvements security-libs/javax.crypto:pkcs11: (P4) JDK-8214459: NSS source should be removed security-libs/javax.net.ssl: (P2) JDK-8140466: ChaCha20 and Poly1305 TLS Cipher Suites (P2) JDK-8209916: NPE in SupportedGroupsExtension (P2) JDK-8214140: Remove TLS v1 and v1.1 from SSLContext required algorithms (P2) JDK-8209333: Socket reset issue for TLS 1.3 socket close (P2) JDK-8214129: SSL session resumption/SNI with TLS1.2 causes StackOverflowError (P2) JDK-8214098: sun.security.ssl.HandshakeHash.T12HandshakeHash constructor check backwards. (P2) JDK-8216045: The size of key_exchange may be wrong on FFDHE (P2) JDK-8211806: TLS 1.3 handshake server name indication is missing on a session resume (P2) JDK-8210334: TLS 1.3 server fails if ClientHello doesn't have pre_shared_key and psk_key_exchange_modes (P2) JDK-8217579: TLS_EMPTY_RENEGOTIATION_INFO_SCSV is disabled after 8211883 (P2) JDK-8210846: TLSv.1.3 interop problems with OpenSSL 1.1.1 when used on the client side with mutual auth (P3) JDK-8212261: Add SSLSession accessors to HttpsURLConnection and SecureCacheResponse (P3) JDK-8208350: Disable all DES cipher suites (P3) JDK-8211883: Disable anon and NULL cipher suites (P3) JDK-8207258: Distrust TLS server certificates anchored by Symantec Root CAs (P3) JDK-8212738: Incorrectly named signature scheme ecdsa_secp512r1_sha512 (P3) JDK-8203687: javax/net/ssl/compatibility/Compatibility.java supports TLS 1.3 (P3) JDK-8210974: No extensions debug log for ClientHello (P3) JDK-8213782: NullPointerException in sun.security.ssl.OutputRecord.changeWriteCiphers (P3) JDK-8213202: Possible race condition in TLS 1.3 session resumption (P3) JDK-8210989: RSASSA-PSS certificate cannot be selected for client auth on TLSv1.2 (P3) JDK-8208641: SSLSocket should throw an exception when configuring DTLS (P3) JDK-8214339: SSLSocketImpl erroneously wraps SocketException (P3) JDK-8209362: sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed due to "BindException: Address already in use (Bind failed)" (P3) JDK-8029661: Support TLS v1.2 algorithm in SunPKCS11 provider (P3) JDK-8209965: The "supported_groups" extension in ServerHellos (P3) JDK-8215443: The use of TransportContext.fatal() leads to bad coding style (P3) JDK-8211866: TLS 1.3 CertificateRequest message sometimes offers disallowed signature algorithms (P3) JDK-8212885: TLS 1.3 resumed session does not retain peer certificate chain (P3) JDK-8214688: TLS 1.3 session resumption with hello retry request failed with "illegal_parameter" (P3) JDK-8210985: Update the default SSL session cache size to 20480 (P4) JDK-8210632: Add key exchange algorithm to javax/net/ssl/TLSCommon/CipherSuite.java (P4) JDK-8210918: Add test to exercise server-side client hello processing (P4) JDK-8203614: Java API SSLEngine example code needs correction (P4) JDK-8214321: Misleading code in SSLCipher (P4) JDK-8211339: NPE during SSL handshake caused by HostnameChecker (P4) JDK-8210785: Trivial typo fix in X509ExtendedKeyManager javadoc (P4) JDK-8212752: Typo in SSL log message related to inactive/disabled signature scheme security-libs/javax.smartcardio: (P3) JDK-6474858: CardChannel.transmit(CommandAPDU) throws unexpected ArrayIndexOutOfBoundsException (P3) JDK-8214570: Use {@systemProperty} for definitions of system properties security-libs/javax.xml.crypto: (P3) JDK-8211878: Bad/broken links in docs/api/java.xml.crypto/javax/xml/crypto/dsig/Reference.html (P4) JDK-8210338: Better output for GenerationTests.java (P4) JDK-8210448: Copy Java XML Digital Signature API Specification into java.xml.crypto javadocs (P4) JDK-8210736: jdk/javax/xml/crypto/dsig/GenerationTests.java slow on linux (P4) JDK-8205507: jdk/javax/xml/crypto/dsig/GenerationTests.java timed out security-libs/jdk.security: (P3) JDK-8209546: Make sun/security/tools/keytool/autotest.sh to support macosx (P4) JDK-8210476: sun/security/mscapi/PrngSlow.java fails with Still too slow security-libs/org.ietf.jgss: (P2) JDK-8209829: SpnegoUnknownMech.java does not contain the SpnegoUnknownMech class (P3) JDK-8186186: GSSContext.isEstablished() can return true on error state (P4) JDK-8212217: JGSS: Don't dispose() of creds too eagerly (P4) JDK-8212165: JGSS: Fix cut/paste error in NativeUtil.c (P4) JDK-8212216: JGSS: Fix leak in exception cases in getJavaOID() security-libs/org.ietf.jgss:krb5: (P4) JDK-8210821: Support dns_canonicalize_hostname in krb5.conf specification/language: (P3) JDK-8214034: 16.1.7: DU/DA in a switch expression (P3) JDK-8214353: 16.1.8: DU/DA in a switch expression (P3) JDK-8198986: 3.10.7: Raw string literals (P3) JDK-8213180: 5.6.3: byte result expression in switch widens to char, but should widen to int (P3) JDK-8192963: JEP 325: Switch Expressions (Preview) (P4) JDK-8205961: 6.3: Put more type names in scope for `uses` and `provides` directives (P4) JDK-8214743: 7.4.2: Tighten the compilation units in an unnamed package specification/vm: (P4) JDK-8205943: 4.1: Allow v56.0 class files for Java SE 12 (P4) JDK-8200338: 4.1: Restrict the legal values of ClassFile.minor_version (P4) JDK-8215035: 4.7.20.2: Clarify placement of type annotations on nested types (P4) JDK-8210840: 6.5: Unwieldy selection for an interface method ref by invokespecial tools: (P2) JDK-8210502: jdeps does not handle properly on analyzing a mixture of MR JARs and non-MR JARs (P3) JDK-8215238: (jdeps) update jdk8_internals.txt per the removal of javafx, corba, EE modules (P3) JDK-8213909: jdeps --print-module-deps should report missing dependences (P3) JDK-8211887: jdeps throws NPE when analyzing javafx.media that references a non-existent class used to be in JDK (P4) JDK-8211051: jdeps usage of --dot-output doesn't provide valid output for modular jar (P4) JDK-8210833: Specs for Javadoc and Pack200 have incorrect link to Copyright page (P5) JDK-8168869: jdeps: localized messages don't use proper line breaks tools/jar: (P3) JDK-8207395: jar should support UNC-path arguments for the jar -C parameter (P3) JDK-8210454: jar tool does not allow setting the module version without also setting the main class tools/javac: (P2) JDK-8214571: -Xdoclint of array serialField gives "error: array type not allowed here" (P2) JDK-8214031: Assertion error in value break statement with conditional operator in switch expression (P2) JDK-8213908: AssertionError in DeferredAttr at setOverloadKind (P2) JDK-8210483: AssertionError in DeferredAttr at setOverloadKind caused by JDK-8203679 (P2) JDK-8210671: CheckExamples.java fail after Raw String Literals checkin (P2) JDK-8210495: compiler crashes because of illegal signature in otherwise legal code (P2) JDK-8193561: Cyclic hierarchy causes a NullPointerException when setting DEFAULT flag (P2) JDK-8214529: Exception while using Anonymous class in switch expression (P2) JDK-8203277: preflow visitor used during lambda attribution shouldn't visit class definitions inside the lambda body (P2) JDK-8215681: Remove compiler support for Raw String Literals from JDK 12 (P2) JDK-8212982: Rule cases in switch expression accepted even if complete normally (P2) JDK-8214113: Switch expressions may have constant type and may be skipped during write (P2) JDK-8214114: Switch expressions with try-catch statements (P3) JDK-8206325: AssertionError in TypeSymbol.getAnnotationTypeMetadata (P3) JDK-8205418: Assorted improvements to source code model (P3) JDK-8214071: Broken msg.bug diagnostics when using the compiler API (P3) JDK-8209055: c.s.t.javac.code.DeferredCompletionFailureHandler seems to use WeakHashMap incorrectly (P3) JDK-8214026: Canonicalized archive paths appearing in diagnostics (P3) JDK-8207160: ClassReader::adjustMethodParams can potentially return null if the args list is empty (P3) JDK-8210561: Command-line help wrong for javac --module (P3) JDK-8206981: Compiler support for Raw String Literals (P3) JDK-8206986: Compiler support for Switch Expressions (Preview) (P3) JDK-8207405: Compiler Tree API support for Switch Expressions (Preview) (P3) JDK-8211102: Crash with -XDfind=lambda and -source 7 (P3) JDK-8210555: create --source --target synonyms for -source -target (P3) JDK-8207954: Data for --release 11 (P3) JDK-8210435: don't add local variable spots if they are DCE'ed by the compiler (P3) JDK-8193462: Fix Filer handling of package-info initial elements (P3) JDK-8208184: IllegalArgumentException while invoking code completion on netbeans IDE (P3) JDK-8198945: Invalid RuntimeVisibleTypeAnnotations for annotation on anonymous class type parameter (P3) JDK-8214514: javac @file option gives error caused by Chinese encoding in the path (P3) JDK-8210197: javac can't tell during speculative attribution if a diamond expression is creating an anonymous inner class or not (P3) JDK-8209173: javac fails with completion exception while reporting an error (P3) JDK-8213703: LambdaConversionException: Invalid receiver type not a subtype of implementation type interface (P3) JDK-8210674: Need to add examples for use of javac properties introduced by Raw String Literals (P3) JDK-8193037: package-info annotations are not reported when annotation processing is enabled (P3) JDK-8190886: package-info handling in RoundEnvironment.getElementsAnnotatedWith (P3) JDK-8213103: RoundEnvironment.getElementsAnnotatedWith(Class) crashes with -source 8 (P3) JDK-8209963: source file mode for JVM should provide a hook to locate the source file (P3) JDK-8210009: Source Launcher classloader should support getResource and getResourceAsStream (P3) JDK-8211450: UndetVar::dup is not copying the kind field to the duplicated instance (P3) JDK-8208608: Update --module-source-path to allow explicit source paths for specific modules (P3) JDK-8211148: var in implicit lambdas shouldn't be accepted for source < 11 (P3) JDK-8209407: VerifyError is thrown for inner class with lambda (P3) JDK-8207320: Wrong type order for intersection lambdas with multiple abstract methods (P4) JDK-8193290: Add source 12 and target 12 to javac (P4) JDK-8209058: Cannot find annotation method 'value()' in type 'Profile+Annotation' (P4) JDK-8183548: Comma-expressions shouldn't use any temporary variable (P4) JDK-8210742: Compound var declaration type is not uniform for all variables (P4) JDK-8206874: Evaluate LoadClassFromJava6CreatedJarTest.java after dropping -source 6 (P4) JDK-8193214: Incorrect annotations.without.processors warnings with JDK 9 (P4) JDK-8209064: Make intellij support more robust after changes for 2018.2 (P4) JDK-8207055: Make javac -help output for -source and -target more informative (P4) JDK-8209022: Missing checkcast when casting to type parameter bounded by intersection type (P4) JDK-8211138: Missing Flag enum constants (P4) JDK-8205493: OptionSmokeTest.java uses hard-coded release values (P4) JDK-8214902: Pretty-printing marker annotations add unnecessary parenthesis (P4) JDK-8207248: Reduce incidence of compiler.warn.source.no.bootclasspath in javac tests (P4) JDK-8206114: Refactor langtools/tools/javac/classfiles/ClassVersionChecker.java (P4) JDK-8206085: Refactor langtools/tools/javac/versions/Versions.java (P4) JDK-8206439: Remove javac -source/-target 6 from langtools regression tests (P4) JDK-8028563: Remove javac support for 6/1.6 source and target values (P4) JDK-8207229: Trees.getScope crashes for broken lambda (P4) JDK-8207230: Trees.getScope runs Analyzers (P5) JDK-8206122: Use Queue in place of ArrayList when need to remove first element tools/javadoc(tool): (P2) JDK-8213956: javadoc crash using {@index} in doc-files file (P2) JDK-8218134: Modify the jQuery.md file to reflect the exact jQuery license content. (P2) JDK-8211127: TestNewLanguageFeatures.java fails after JDK-8173730 (P3) JDK-8208531: -javafx mode should be on by default when JavaFX is available (P3) JDK-8211407: Bad links to non-existent entries on serialized-form page (P3) JDK-8207214: Broken links in JDK API serialized-form page (P3) JDK-8215291: Broken links when generating from project without modules (P3) JDK-8184205: Captions on tabbed tables are squashed together (P3) JDK-8213819: doclint should warn against {@index} inside tag (P3) JDK-8214856: Errors with JSZip in web console after upgrade to 3.1.5 (P3) JDK-8186260: Improve javadoc tag specification. (P3) JDK-8190312: javadoc -link doesn't work with http: -> https: URL redirects (P3) JDK-8212233: javadoc fails on jdk12 with "The code being documented uses modules but the packages defined in $URL are in the unnamed module." (P3) JDK-8200432: javadoc fails with ClassCastException on {@link byte[]} (P3) JDK-8211901: javadoc generates broken links on deprecated items page (P3) JDK-8187794: javadoc navigation bar needs cleanup (P3) JDK-8210405: Javadoc search doesn't always consider full input upon Enter (P3) JDK-8209914: javadoc search sometimes generates bad URIs (P3) JDK-8213709: jdk/javadoc/doclet/testValueTag/TestValueTagInModule.java missing modules declaration (P3) JDK-8214468: jQuery UI upgrade from 1.11.4 to 1.12.1 (P3) JDK-8202959: Rearrange the top and bottom navigation bar in the javadoc generated pages (P3) JDK-8203792: Remove "compatibility" features from Head.java (P3) JDK-8203791: Remove "compatibility" features from Table.java (P3) JDK-8214139: Remove wrapper methods from {Base,Html}Configuration (P3) JDK-8210245: Review URLs in javadoc Tag Specification (P3) JDK-8210683: Search result display order reversed for overloaded entries (P3) JDK-8199192: Some pages generated by javadoc contain accessibility issues (P3) JDK-5076751: System properties documentation needed in javadocs (P3) JDK-8213526: Update javadoc tag specification to include systemProperty taglet (P3) JDK-8213133: Update javadoc tag specification to include value taglet in module documentation (P3) JDK-8202462: {@index} may cause duplicate labels (P3) JDK-8210244: {@value} should be permitted in module documentation (P4) JDK-8208484: color contrast issues in a couple of spec files (P4) JDK-8206318: Enhance package documentation for internal javadoc packages (P4) JDK-8213265: fix missing newlines at end of files (P4) JDK-8205593: Javadoc -link makes broken links if module name matches package name (P4) JDK-8208269: Javadoc does not support module-info in a multi-release jar (P4) JDK-8213716: javadoc search not working with Japanese and Chinese locales (P4) JDK-8176453: Javadoc search: there are issues with generics in parameters (P4) JDK-8209052: Low contrast in docs/api/constant-values.html (P4) JDK-8206475: Repeated word in error message (P4) JDK-8210047: some pages contain content outside of landmark region (P4) JDK-8173730: Stop including enhanced for-loop tip for enum values() method tools/jconsole: (P3) JDK-8210087: Classes in jdk.unsupported not accessible from jconsole plugin tools/jlink: (P3) JDK-8215123: Crash in runtime image built with jlink --compress=2 (P3) JDK-8215026: Incorrect amount of memory unmapped with ImageFileReader::close() (P4) JDK-8214230: Classes generated by SystemModulesPlugin.java are not reproducable (P4) JDK-8206962: jlink --release-info=del throws NPE if no keys are specified (P4) JDK-8211976: move testlibrary/ModuleTargetHelper.java closer to tests (P4) JDK-8212137: Remove JrtFileSystem finalize method tools/jshell: (P2) JDK-8215438: jshell tool: Ctrl-D causes EOF (P3) JDK-8215244: jdk/jshell/ToolBasicTest.java testHistoryReference failed (P3) JDK-8210596: jshell does not support raw string literals (P3) JDK-8213725: JShell NullPointerException due to class file with unexpected package (P3) JDK-8215243: JShell tests failing intermitently with "Problem cleaning up the following threads:" (P3) JDK-8215099: jshell tool: /help representation of ctrl/meta characters inconsistent (P3) JDK-8210808: jshell tool: only considers the first snippet of the external editor (P3) JDK-8211694: JShell: Redeclared variable should be reset (P3) JDK-8210923: JShell: support for switch expressions (P3) JDK-8214491: Upgrade to JLine 3.9.0 (P4) JDK-8209386: [error-prone] StreamResourceLeak in jdk.internal.ed module (P4) JDK-8210959: JShell fails and exits when statement throws an exception whose message contains a '%'. tools/launcher: (P2) JDK-8213362: [macOS] Could not find libjava.dylib error when initializing JVM via JNI_CreateJavaVM (P2) JDK-8215000: tools/launcher/JliLaunchTest.java fails on Windows (P3) JDK-8210810: Escaped character at specific position in argument file is not handled properly (P3) JDK-8210839: Improve interaction between source launcher and classpath (P3) JDK-8210274: Source Launcher should work with a security manager (P4) JDK-8210275: Source Launcher should fail if --source is used without a source file xml: (P3) JDK-8212872: Broken link to Namespaces in XML Errata xml/javax.xml.stream: (P3) JDK-8209615: ParseError in XMLEventReader on a valid input (P4) JDK-8204329: Java API doc for XMLStreamReader.next() needs to be clarified for the exception thrown when hasNext() method returns false (P4) JDK-8212178: Soft reference reclamation race in com.sun.xml.internal.stream.util.ThreadLocalBufferAllocator (P4) JDK-8194680: StartElement#getAttributes and getNamespaces refer to incorrect package (P4) JDK-8210874: Test for JDK-8209615 xml/javax.xml.transform: (P4) JDK-8207760: SAXException: Invalid UTF-16 surrogate detected: d83c ? xml/javax.xml.validation: (P3) JDK-8212866: Broken link to schematron.com (P4) JDK-8209873: Typo in javax.xml.validation.Validator.validate​ documentation xml/jaxp: (P3) JDK-8177286: AttributeSet: attempt to compare Qname and String (P3) JDK-8213321: Fix legal headers in test/jaxp (P3) JDK-8206164: forgot to "throw" TransformerConfigurationException (P3) JDK-8213300: jaxp/unittest/transform/CR6551600Test.java fails due to exception in jdk/jdk CI (P4) JDK-8210722: JAXP Tests: CatalogSupport2 and CatalogSupport3 generate incorrect messages upon failure (P4) JDK-8190835: Subtraction with two javax.xml.datatype.Duration gives incorrect result xml/org.w3c.dom: (P3) JDK-8212871: Broken links give 401-Unauthorized (P3) JDK-8212876: ftp: links for character-sets require a login password (P4) JDK-8213117: adoptNode corrupts attribute values xml/org.xml.sax: (P4) JDK-8213734: SAXParser.parse(File, ..) does not close resources when Exception occurs.