Key:

JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X

CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

New in release OpenJDK 11.0.10 (2021-01-19):

=============================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk11010

  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.10.txt

* Security fixes

  - JDK-8247619: Improve Direct Buffering of Characters

* Other changes

  - JDK-6722928: Support SSPI as a native GSS-API provider

  - JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()

  - JDK-8152332: [macosx] JFileChooser cannot be serialized on Mac OS X

  - JDK-8161684: [testconf] Add VerifyOops' testing into compiler tiers

  - JDK-8171279: Support X25519 and X448 in TLS

  - JDK-8173361: various crashes in JvmtiExport::post_compiled_method_load

  - JDK-8173658: JvmtiExport::post_class_unload() is broken for non-JavaThread initiators

  - JDK-8191006: hsdis disassembler plugin does not compile with binutils 2.29+

  - JDK-8197981: Missing return statement in __sync_val_compare_and_swap_8

  - JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode

  - JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/

  - JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/

  - JDK-8208483: Add 5 JNDI tests to com/sun/jndi/dns/FactoryTests/

  - JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/

  - JDK-8208665: Amend cross-compilation docs with qemu-debootstrap recipe

  - JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java

  - JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/

  - JDK-8211450: UndetVar::dup is not copying the kind field to the duplicated instance

  - JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL) failed: resolving NULL _value"

  - JDK-8212226: SurfaceManager throws "Invalid Image variant" for MultiResolutionImage (Windows)

  - JDK-8213400: Support choosing group name in keytool keypair generation

  - JDK-8213535: Windows HiDPI html lightweight tooltips are truncated

  - JDK-8213698: Improve devkit creation and add support for linux/ppc64/ppc64le/s390x

  - JDK-8214025: assert(t->singleton()) failed: must be a constant when ScavengeRootsInCode < 2

  - JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java fails because of missing UnlockDiagnosticVMOptions

  - JDK-8214787: Zero builds fail with "undefined JavaThread::thread_state()"

  - JDK-8215583: Exclude runtime/handshake/HandshakeWalkSuspendExitTest.java

  - JDK-8216012: Infinite loop in RSA KeyPairGenerator

  - JDK-8216324: GetClassMethods is confused by the presence of default methods in super interfaces

  - JDK-8217429: WebSocket over authenticating proxy fails to send Upgrade headers

  - JDK-8217976: test/jdk/java/net/httpclient/websocket/WebSocketProxyTest.java fails intermittently

  - JDK-8218021: Have jarsigner preserve posix permission attributes

  - JDK-8218287: jshell tool: input behavior unstable after 12-ea+24 on Windows

  - JDK-8218851: JVM crash in custom classloader stress test, JDK 12 & 13

  - JDK-8220420: Cleanup c1_LinearScan

  - JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad events to wrong jvmtiEnv

  - JDK-8222286: Fix for JDK-8213419 is broken on s390

  - JDK-8222527: HttpClient doesn't send HOST header when tunelling HTTP/1.1 through http proxy

  - JDK-8222533: jtreg test jdk/internal/platform/cgroup/TestCgroupMetrics.java fails on SLES12.3 linux ppc64le machine

  - JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails with exitValue = 137

  - JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/tc02t001/TestDescription.java failed

  - JDK-8224650: Add tests to support X25519 and X448 in TLS

  - JDK-8225072: Add LuxTrust certificate that is expiring in March 2021 to list of allowed but expired certs

  - JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash during initialization on Windows platforms

  - JDK-8225687: Newly added sspi.cpp in JDK-6722928 still contains some small errors

  - JDK-8227006: [linux] Runtime.availableProcessors execution time increased by factor of 100

  - JDK-8227275: Within native OOM error handling, assertions may hang the process

  - JDK-8227647: [Graal] Test8009761.java fails due to "RuntimeException: static java.lang.Object compiler.uncommontrap.Test8009761.m3(boolean,boolean) not compiled"

  - JDK-8229495: SIGILL in C2 generated OSR compilation

  - JDK-8230910: libsspi_bridge does not build on Windows 32bit

  - JDK-8232114: JVM crashed at imjpapi.dll in native code

  - JDK-8234147: Avoid looking up standard charsets in core libraries

  - JDK-8234393: [macos] printing ignores printer tray

  - JDK-8234863: Increase default value of MaxInlineLevel

  - JDK-8235218: Minimal VM is broken after JDK-8173361

  - JDK-8235456: Minimal VM is broken after JDK-8212160

  - JDK-8235829: graal crashes with Zombie.java test

  - JDK-8236124: Minimal VM slowdebug build failed after JDK-8212160

  - JDK-8236512: PKCS11 Connection closed after Cipher.doFinal and NoPadding

  - JDK-8236944: The legVecZ operand should be limited to zmm0-zmm15 registers

  - JDK-8237186: Fix typo in copyright header of java/io/Reader/TransferTo.java

  - JDK-8237499: JFR: Include stack trace in the ThreadStart event

  - JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob

  - JDK-8237524: AArch64: String.compareTo() may return incorrect result

  - JDK-8237950: C2 compilation fails with "Live Node limit exceeded limit" during ConvI2L::Ideal optimization

  - JDK-8238579: HttpsURLConnection drops the timeout and hangs forever in read

  - JDK-8239105: Add exception for expiring Digicert root certificates to VerifyCACerts test

  - JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails -XX:+VerifyOops with "verify_oop: rsi: broken oop"

  - JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&)

  - JDK-8239886: Minimal VM build fails after JDK-8237499

  - JDK-8240633: Memory leaks in the implementations of FileChooserUI

  - JDK-8240690: Race condition between EDT and BasicDirectoryModel.FilesLoader.run0()

  - JDK-8241234: Unify monitor enter/exit runtime entries.

  - JDK-8241311: Move some charset mapping tests from closed to open

  - JDK-8241797: Add some tests to the problem list

  - JDK-8242029: AArch64: skip G1 array copy pre-barrier if marking not active

  - JDK-8242335: Additional Tests for RSASSA-PSS

  - JDK-8242480: Negative value may be returned by getFreeSwapSpaceSize() in the docker

  - JDK-8242614: cleanup duplicated test ldap server in some com/sun/jndi/ldap/ tests

  - JDK-8242846: Bring back test/jdk/tools/jlink/plugins/OrderResourcesPluginTest.java

  - JDK-8243114: Implement montgomery{Multiply,Square}intrinsics on Windows

  - JDK-8243290: Improve diagnostic messages for class verification and redefinition failures

  - JDK-8243488: Add tests for set/get SendBufferSize and getReceiveBufferSize in DatagramSocket

  - JDK-8243549: sun/security/ssl/CipherSuite/NamedGroupsWithCipherSuite.java failed with Unsupported signature algorithm: DSA

  - JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test uses wrong class

  - JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java test misses -version

  - JDK-8244142: some hotspot/runtime tests don't check exit code of forked JVM

  - JDK-8244278: Excessive code cache flushes and sweeps

  - JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/Test8237524.java fails with --illegal-access=deny

  - JDK-8244621: [macos10.15] Garbled FX printing plus CoreText warnings on Catalina when building with Xcode 11

  - JDK-8244819: hsdis does not compile with binutils 2.34+

  - JDK-8245051: c1 is broken if it is compiled by gcc without -fno-lifetime-dse

  - JDK-8245168: jlink should not be treated as a "small" tool

  - JDK-8245400: Upgrade to LittleCMS 2.11

  - JDK-8246381: VM crashes with "Current BasicObjectLock* below than low_mark"

  - JDK-8246434: Threads::print_on_error assumes that the heap has been set up

  - JDK-8246648: issue with OperatingSystemImpl getFreeSwapSpaceSize in docker after 8242480

  - JDK-8247201: Print potential pointer value of readable stack memory in hs_err file

  - JDK-8247763: assert(outer->outcnt() == 2) failed: 'only phis' failure in LoopNode::verify_strip_mined()

  - JDK-8247867: Upgrade to freetype 2.10.2

  - JDK-8248190: Enable Power10 system and implement new byte-reverse instructions

  - JDK-8248226: TestCloneAccessStressGCM fails with -XX:-ReduceBulkZeroing

  - JDK-8248347: windows build broken by JDK-8243114

  - JDK-8248532: Every time I change keyboard language at my MacBook, Java crashes

  - JDK-8248552: C2 crashes with SIGFPE due to division by zero

  - JDK-8248596: [TESTBUG] compiler/loopopts/PartialPeelingUnswitch.java times out with Graal enabled

  - JDK-8248745: Add jarsigner and keytool tests for restricted algorithms

  - JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing

  - JDK-8248845: AArch64: stack corruption after spilling vector register

  - JDK-8249176: Update GlobalSignR6CA test certificates

  - JDK-8249183: JVM crash in "AwtFrame::WmSize" method

  - JDK-8249192: MonitorInfo stores raw oops across safepoints

  - JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions allowed

  - JDK-8249603: C1: assert(has_error == false) failed: register allocation invalid

  - JDK-8249605: C2: assert(no_dead_loop) failed: dead loop detected

  - JDK-8249607: C2: assert(!had_error) failed: bad dominance

  - JDK-8249608: Vector register used by C2 compiled method corrupted at safepoint

  - JDK-8249672: Include microcode revision in features_string on x86

  - JDK-8249748: gtest silently ignores bad jvm arguments

  - JDK-8249821: Separate libharfbuzz from libfontmanager

  - JDK-8250598: Hyper-V is detected in spite of running on host OS

  - JDK-8250605: Linux x86_32 builds fail after JDK-8249821

  - JDK-8250636: iso8601_time returns incorrect offset part on MacOS

  - JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY

  - JDK-8250772: Test com/sun/jndi/ldap/NamingExceptionMessageTest.java fails intermittently with javax.naming.ServiceUnavailableException

  - JDK-8250825: C2 crashes with assert(field != __null) failed: missing field

  - JDK-8250894: Provide a configure option to build and run against the platform libharfbuzz

  - JDK-8250928: JFR: Improve hash algorithm for stack traces

  - JDK-8250968: Symlinks attributes not preserved when using jarsigner on zip files

  - JDK-8250984: Memory Docker tests fail on some Linux kernels w/o cgroupv1 swap limit capabilities

  - JDK-8251118: BiasedLocking::preserve_marks should not have a HandleMark

  - JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java failed due to timeout

  - JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes target VM

  - JDK-8251365: Build failure on AIX after 8250636

  - JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray

  - JDK-8251456: [TESTBUG] compiler/vectorization/TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError

  - JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt >= 0) failed"

  - JDK-8251535: Partial peeling at unsigned test adds incorrect loop exit check

  - JDK-8251949: ZGC: Set explicit heap size for compiler/gcbarriers tests

  - JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks in an infinite loop OpenJDK (build 13.0.1+9)

  - JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10

  - JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails on Windows

  - JDK-8252497: Incorrect numeric currency code for ROL

  - JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize option

  - JDK-8252679: Two windows specific FileDIalog tests may fail on some Windows_Server_2016_Standard

  - JDK-8252696: Loop unswitching may cause out of bound array load to be executed

  - JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent

  - JDK-8253219: Epsilon: clean up unnecessary includes

  - JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor calls virtual num_queues()

  - JDK-8253226: Shenandoah: remove unimplemented ShenandoahStrDedupQueue::verify

  - JDK-8253269: The CheckCommonColors test should provide more info on failure

  - JDK-8253284: Zero OrderAccess barrier mappings are incorrect

  - JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)

  - JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint should not access VMThread state from other threads

  - JDK-8253791: Issue with useAppleColor check in CSystemColors.m

  - JDK-8254016: Test8237524 fails with -XX:-CompactStrings option

  - JDK-8254081: java/security/cert/PolicyNode/GetPolicyQualifiers.java fails due to an expired certificate

  - JDK-8254144: Non-x86 Zero builds fail with return-type warning in os_linux_zero.cpp

  - JDK-8254166: Zero: return-type warning in zeroInterpreter_zero.cpp

  - JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b

  - JDK-8254185: Fix Code cache sweeper heuristics for JDK 11

  - JDK-8254190: [s390] interpreter misses exception check after calling monitorenter

  - JDK-8254790: SIGSEGV in string_indexof_char and stringL_indexof_char intrinsics

  - JDK-8254854: [cgroups v1] Metric limits not properly detected on some join controller combinations

  - JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c

  - JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list

  - JDK-8255065: Zero: accessor_entry misses the IRIW case

  - JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d

  - JDK-8255269: Unsigned overflow in g1Policy.cpp

  - JDK-8255365: Problem list failing client manual tests

  - JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask

  - JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0

  - JDK-8255550: x86: Assembler::cmpq(Address dst, Register src) encoding is incorrect

  - JDK-8255603: Memory/Performance regression after JDK-8210985

  - JDK-8255760: Shenandoah: match constants style in ShenandoahMarkTask fallback

  - JDK-8255937: Better cleanup for test/jdk/javax/imageio/stream/StreamFlush.java

  - JDK-8256427: Test com/sun/jndi/dns/ConfigTests/PortUnreachable.java does not work on AIX

  - JDK-8256452: Integrate missing part of JDK-8232370 to 11u

  - JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/libOverpassMethods.c fails to compile on gcc 4.4.x

  - JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to -Wl,-z,defs

  - JDK-8256618: Zero: Linux x86_32 build still fails

  - JDK-8256736: Zero: GTest tests fail with "unsuppported vm variant"

  - JDK-8256809: Annotation processing causes NPE during flow analysis

  - JDK-8257181: s390x builds are very noisy with gc-sections messages

  - JDK-8257242: [macOS] Java app crashes while switching input methods

  - JDK-8257545: SunJSSE FIPS regression in key exchange after JDK-8171279 11u backport

  - JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint() from control thread should return false

  - JDK-8257701: Shenandoah: objArrayKlass metadata is not marked with chunked arrays

  - JDK-8258630: Add expiry exception for QuoVadis root certificate

Notes on individual issues:

===========================

security-libs/java.security:

JDK-8213821: -groupname Option Added to keytool Key Pair Generation

===================================================================

A new `-groupname` option has been added to `keytool -genkeypair` so

that a user can specify a named group when generating a key pair. For

example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will

generate an EC key pair by using the `secp384r1` curve. Because there

might be multiple curves with the same size, using the `-groupname`

option is preferred over the `-keysize` option.

JDK-8248263: jarsigner Preserves POSIX File Permission and symlink Attributes

=============================================================================

When signing a file that contains POSIX file permission or symlink

attributes, `jarsigner` now preserves these attributes in the newly

signed file but warns that these attributes are unsigned and not

protected by the signature. The same warning is printed during the

`jarsigner -verify` operation for such files.

Note that the `jar` tool does not read/write these attributes. This

change is more visible to tools like `unzip` where these attributes

are preserved.

security-libs/javax.net.ssl:

JDK-8225764:  Support for X25519 and X448 in TLS

================================================

The named elliptic curve groups `x25519` and `x448` are now available

for JSSE key agreement in TLS versions 1.0 to 1.3, with `x25519` being

the most preferred of the default enabled named groups.  The default

ordered list is now:

* x25519

* secp256r1

* secp384r1

* secp521r1

* x448

* secp256k1

* ffdhe2048

* ffdhe3072

* ffdhe4096

* ffdhe6144

* ffdhe8192

The default list can be overridden using the system property *`jdk.tls.namedGroups`*.

security-libs/org.ietf.jgss:

JDK-8214079: Added a Default Native GSS-API Library on Windows

==============================================================

A native GSS-API library has been added to JDK on the Windows

platform. The library is client-side only and uses the default

credentials. It will be loaded when the `sun.security.jgss.native`

system property is set to "true". A user can still load a third-party

native GSS-API library by setting the system property

`sun.security.jgss.lib` to its path.

New in release OpenJDK 11.0.9.1 (2020-10-20):

=============================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk11091

  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.9.1.txt

* Regression fixes

  - JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)

New in release OpenJDK 11.0.9 (2020-10-20):

===========================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk1109

  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.9.txt

* Security fixes

  - JDK-8233624: Enhance JNI linkage

  - JDK-8236196: Improve string pooling

  - JDK-8236862, CVE-2020-14779: Enhance support of Proxy class

  - JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts

  - JDK-8237995, CVE-2020-14782: Enhance certificate processing

  - JDK-8240124: Better VM Interning

  - JDK-8241114, CVE-2020-14792: Better range handling

  - JDK-8242680, CVE-2020-14796: Improved URI Support

  - JDK-8242685, CVE-2020-14797: Better Path Validation

  - JDK-8242695, CVE-2020-14798: Enhanced buffer support

  - JDK-8243302: Advanced class supports

  - JDK-8244136, CVE-2020-14803: Improved Buffer supports

  - JDK-8244479: Further constrain certificates

  - JDK-8244955: Additional Fix for JDK-8240124

  - JDK-8245407: Enhance zoning of times

  - JDK-8245412: Better class definitions

  - JDK-8245417: Improve certificate chain handling

  - JDK-8248574: Improve jpeg processing

  - JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit

  - JDK-8253019: Enhanced JPEG decoding

* Other changes

  - JDK-6532025: GIF reader throws misleading exception with truncated images

  - JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/PDialogTest.java needs update by removing a infinite loop

  - JDK-8022535: [TEST BUG] javax/swing/text/html/parser/Test8017492.java fails

  - JDK-8062947: Fix exception message to correctly represent LDAP connection failure

  - JDK-8067354: com/sun/jdi/GetLocalVariables4Test.sh failed

  - JDK-8134599: TEST_BUG: java/rmi/transport/closeServerSocket/CloseServerSocket.java fails intermittently with Address already in use

  - JDK-8151678: com/sun/jndi/ldap/LdapTimeoutTest.java failed due to timeout on DeadServerNoTimeoutTest is incorrect

  - JDK-8160768: Add capability to custom resolve host/domain names within the default JNDI LDAP provider

  - JDK-8172404: Tools should warn if weak algorithms are used before restricting them

  - JDK-8193367: Annotated type variable bounds crash javac

  - JDK-8202117: com/sun/jndi/ldap/RemoveNamingListenerTest.java fails intermittently: Connection reset

  - JDK-8203026: java.rmi.NoSuchObjectException: no such object in table

  - JDK-8203281: [Windows] JComboBox change in ui when editor.setBorder() is called

  - JDK-8203382: Rename SystemDictionary::initialize_wk_klass to resolve_wk_klass

  - JDK-8203393: com/sun/jdi/JdbMethodExitTest.sh and JdbExprTest.sh fail due to timeout

  - JDK-8203928: [Test] Convert non-JDB scaffolding serviceability shell script tests to java

  - JDK-8204963: javax.swing.border.TitledBorder has a memory leak

  - JDK-8204994: SA might fail to attach to process with "Windbg Error: WaitForEvent failed"

  - JDK-8205534: Remove SymbolTable dependency from serviceability agent

  - JDK-8206309: Tier1 SA tests fail

  - JDK-8208281: java/nio/channels/AsynchronousSocketChannel/Basic.java timed out

  - JDK-8209109: [TEST] rewrite com/sun/jdi shell tests to java version - step1

  - JDK-8209332: [TEST] test/jdk/com/sun/jdi/CatchPatternTest.sh is incorrect

  - JDK-8209342: Problemlist SA tests on Solaris due to Error attaching to process: Can't create thread_db agent!

  - JDK-8209343: Test javax/swing/border/TestTitledBorderLeak.java should be marked as headful

  - JDK-8209517: com/sun/jdi/BreakpointWithFullGC.java fails with timeout

  - JDK-8209604: [TEST] rewrite com/sun/jdi shell tests to java version - step2

  - JDK-8209605: com/sun/jdi/BreakpointWithFullGC.java fails with ZGC

  - JDK-8209608: Problem list com/sun/jdi/BreakpointWithFullGC.java

  - JDK-8210131: vmTestbase/nsk/jvmti/scenarios/allocation/AP10/ap10t001/TestDescription.java failed with ObjectFree: GetCurrentThreadCpuTimerInfo returned unexpected error code

  - JDK-8210243: [TEST] rewrite com/sun/jdi shell tests to java version - step3

  - JDK-8210527: JShell: NullPointerException in jdk.jshell.Eval.translateExceptionStack

  - JDK-8210560: [TEST] convert com/sun/jdi redefineClass-related tests

  - JDK-8210725: com/sun/jdi/RedefineClearBreakpoint.java fails with waitForPrompt timed out after 60 seconds

  - JDK-8210748: [TESTBUG] lib.jdb.Jdb.waitForPrompt() should clarify which output is the pending reply after a timeout

  - JDK-8210760: [TEST] rewrite com/sun/jdi shell tests to java version - step4

  - JDK-8210977: jdk/jfr/event/oldobject/TestThreadLocalLeak.java fails to find ThreadLocalObject

  - JDK-8211292: [TEST] convert com/sun/jdi/DeferredStepTest.sh test

  - JDK-8211694: JShell: Redeclared variable should be reset

  - JDK-8212200: assert when shared java.lang.Object is redefined by JVMTI agent

  - JDK-8212629: [TEST] wrong breakpoint in test/jdk/com/sun/jdi/DeferredStepTest

  - JDK-8212665: com/sun/jdi/DeferredStepTest.java: jj1 (line 57) - unexpected. lastLine=52, minLine=52, maxLine=55

  - JDK-8212807: tools/jar/multiRelease/Basic.java times out

  - JDK-8213182: Minimal VM build failure after JDK-8212200 (assert when shared java.lang.Object is redefined by JVMTI agent)

  - JDK-8213214: Set -Djava.io.tmpdir= when running tests

  - JDK-8213275: ReplaceCriticalClasses.java fails with jdk.internal.vm.PostVMInitHook not found

  - JDK-8213574: Deadlock in string table expansion when dumping lots of CDS classes

  - JDK-8213703: LambdaConversionException: Invalid receiver type not a subtype of implementation type interface

  - JDK-8214074: Ghash optimization using AVX instructions

  - JDK-8214491: Upgrade to JLine 3.9.0

  - JDK-8214797: TestJmapCoreMetaspace.java timed out

  - JDK-8215243: JShell tests failing intermitently with \"Problem cleaning up the following threads:\"

  - JDK-8215244: jdk/jshell/ToolBasicTest.java testHistoryReference failed

  - JDK-8215354: x86_32 build failures after JDK-8214074 (Ghash optimization using AVX instructions)

  - JDK-8215438: jshell tool: Ctrl-D causes EOF

  - JDK-8216021: RunTest.gmk might set concurrency level to 1 on Windows

  - JDK-8216974: HttpConnection not returned to the pool after 204 response

  - JDK-8218948: SimpleDateFormat :: format - Zone Names are not reflected correctly during run time

  - JDK-8219712: code_size2 (defined in stub_routines_x86.hpp) is too small on new Skylake CPUs

  - JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs instead of aliased B&W glyphs

  - JDK-8221658: aarch64: add necessary predicate for ubfx patterns

  - JDK-8221759: Crash when completing \"java.io.File.path\"

  - JDK-8221918: runtime/SharedArchiveFile/serviceability/ReplaceCriticalClasses.java fails: Shared archive not found

  - JDK-8222074: Enhance auto vectorization for x86

  - JDK-8222079: Don't use memset to initialize fields decode_env constructor in disassembler.cpp

  - JDK-8222769: [TESTBUG] TestJFRNetworkEvents should not rely on hostname command

  - JDK-8223688: JShell: crash on the instantiation of raw anonymous class

  - JDK-8223777: In posix_spawn mode, failing to exec() jspawnhelper does not result in an error

  - JDK-8223940: Private key not supported by chosen signature algorithm

  - JDK-8224184: jshell got IOException at exiting with AIX

  - JDK-8224234: compiler/codegen/TestCharVect2.java fails in test_mulc

  - JDK-8225037: java.net.JarURLConnection::getJarEntry() throws NullPointerException

  - JDK-8225625: AES Electronic Codebook (ECB) encryption and decryption optimization using AVX512 + VAES instructions

  - JDK-8226536: Catch OOM from deopt that fails rematerializing objects

  - JDK-8226575: OperatingSystemMXBean should be made container aware

  - JDK-8226697: Several tests which need the @key headful keyword are missing it.

  - JDK-8226809: Circular reference in printed stack trace is not correctly indented & ambiguous

  - JDK-8227059: sun/security/tools/keytool/DefaultSignatureAlgorithm.java timed out

  - JDK-8227269: Slow class loading when running with JDWP

  - JDK-8227595: keytool/fakegen/DefaultSignatureAlgorithm.java fails due to "exitValue = 6"

  - JDK-8228448: Jconsole can't connect to itself

  - JDK-8228967: Trust/Key store and SSL context utilities for tests

  - JDK-8229378: jdwp library loader in linker_md.c quietly truncates on buffer overflow

  - JDK-8229815: Upgrade Jline to 3.12.1

  - JDK-8230000: some httpclients testng tests run zero test

  - JDK-8230002: javax/xml/jaxp/unittest/transform/SecureProcessingTest.java runs zero test

  - JDK-8230010: Remove jdk8037819/BasicTest1.java

  - JDK-8230094: CCE in createXMLEventWriter(Result) over an arbitrary XMLStreamWriter

  - JDK-8230402: Allocation of compile task fails with assert: "Leaking compilation tasks?"

  - JDK-8230767: FlightRecorderListener returns null recording

  - JDK-8230870: (zipfs) Add a ZIP FS test that is similar to test/jdk/java/util/zip/EntryCount64k.java

  - JDK-8231209: [REDO] ThreadMXBean::getThreadAllocatedBytes() can be quicker for self thread

  - JDK-8231586: enlarge encoding space for OopMapValue offsets

  - JDK-8231953: Wrong assumption in assertion in oop::register_oop

  - JDK-8231968: getCurrentThreadAllocatedBytes default implementation s/b getThreadAllocatedBytes

  - JDK-8232083: Minimal VM is broken after JDK-8231586

  - JDK-8232161: Align some one-way conversion in MS950 charset with Windows

  - JDK-8232855: jshell missing word in /help help

  - JDK-8233027: OopMapSet::all_do does oms.next() twice during iteration

  - JDK-8233228: Disable weak named curves by default in TLS, CertPath, and Signed JAR

  - JDK-8233386: Initialize NULL fields for unused decorations

  - JDK-8233452: java.math.BigDecimal.sqrt() with RoundingMode.FLOOR results in incorrect result

  - JDK-8233686: XML transformer uses excessive amount of memory

  - JDK-8233741: AES Countermode (AES-CTR) optimization using AVX512 + VAES instructions

  - JDK-8233829: javac cannot find non-ASCII module name under non-UTF8 environment

  - JDK-8233958: Memory retention due to HttpsURLConnection finalizer that serves no purpose

  - JDK-8234011: (zipfs) Memory leak in ZipFileSystem.releaseDeflater()

  - JDK-8234058: runtime/CompressedOops/CompressedClassPointers.java fails with 'Narrow klass base: 0x0000000000000000' missing from stdout/stderr

  - JDK-8234149: Several regression tests do not dispose Frame at end

  - JDK-8234347: "Turkey" meta time zone does not generate composed localized names

  - JDK-8234385: [TESTBUG] java/awt/EventQueue/6980209/bug6980209.java fails in linux nightly

  - JDK-8234535: Cross compilation fails due to missing CFLAGS for the BUILD_CC

  - JDK-8234541: C1 emits an empty message when it inlines successfully

  - JDK-8234687: change javap reporting on unknown attributes

  - JDK-8236464: SO_LINGER option is ignored by SSLSocket in JDK 11

  - JDK-8236548: Localized time zone name inconsistency between English and other locales

  - JDK-8236617: jtreg test containers/docker/TestMemoryAwareness.java fails after 8226575

  - JDK-8237182: Update copyright header for shenandoah and epsilon files

  - JDK-8237888: security/infra/java/security/cert/CertPathValidator/certification/LuxTrustCA.java fails when checking validity interval

  - JDK-8237977: Further update javax/net/ssl/compatibility/Compatibility.java

  - JDK-8238270: java.net HTTP/2 client does not decrease stream count when receives 204 response

  - JDK-8238284: [macos] Zero VM build fails due to an obvious typo

  - JDK-8238380: java.base/unix/native/libjava/childproc.c "multiple definition" link errors with GCC10

  - JDK-8238386: (sctp) jdk.sctp/unix/native/libsctp/SctpNet.c "multiple definition" link errors with GCC10

  - JDK-8238388: libj2gss/NativeFunc.o "multiple definition" link errors with GCC10

  - JDK-8238448: RSASSA-PSS signature verification fail when using certain odd key sizes

  - JDK-8238710: LingeredApp doesn't log stdout/stderr if exits with non-zero code

  - JDK-8239083: C1 assert(known_holder == NULL || (known_holder->is_instance_klass() && (!known_holder->is_interface() || ((ciInstanceKlass*)known_holder)->has_nonstatic_concrete_methods())), "should be non-static concrete method");

  - JDK-8239385: KerberosTicket client name refers wrongly to sAMAccountName in AD

  - JDK-8240169: javadoc fails to link to non-modular api docs

  - JDK-8240295: hs_err elapsed time in seconds is not accurate enough

  - JDK-8240360: NativeLibraryEvent has wrong library name on Linux

  - JDK-8240676: Meet not symmetric failure when running lucene on jdk8

  - JDK-8241007: Shenandoah: remove ShenandoahCriticalControlThreadPriority support

  - JDK-8241065: Shenandoah: remove leftover code after JDK-8231086

  - JDK-8241086: Test runtime/NMT/HugeArenaTracking.java is failing on 32bit Windows

  - JDK-8241130: com.sun.jndi.ldap.EventSupport.removeDeadNotifier: java.lang.NullPointerException

  - JDK-8241138: http.nonProxyHosts=* causes StringIndexOutOfBoundsException in DefaultProxySelector

  - JDK-8241319: WB_GetCodeBlob doesn't have ResourceMark

  - JDK-8241478: vmTestbase/gc/gctests/Steal/steal001/steal001.java fails with OOME

  - JDK-8241574: Shenandoah: remove ShenandoahAssertToSpaceClosure

  - JDK-8241750: x86_32 build failure after JDK-8227269

  - JDK-8242184: CRL generation error with RSASSA-PSS

  - JDK-8242283: Can't start JVM when java home path includes non-ASCII character

  - JDK-8242556: Cannot load RSASSA-PSS public key with non-null params from byte array

  - JDK-8243029: Rewrite javax/net/ssl/compatibility/Compatibility.java with a flexible interop test framework

  - JDK-8243138: Enhance BaseLdapServer to support starttls extended request

  - JDK-8243320: Add SSL root certificates to Oracle Root CA program

  - JDK-8243321: Add Entrust root CA - G4 to Oracle Root CA program

  - JDK-8243389: enhance os::pd_print_cpu_info on linux

  - JDK-8243453: java --describe-module failed with non-ASCII module name under non-UTF8 environment

  - JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp

  - JDK-8243489: Thread CPU Load event may contain wrong data for CPU time under certain conditions

  - JDK-8243925: Toolkit#getScreenInsets() returns wrong value on HiDPI screens (Windows)

  - JDK-8244087: 2020-04-24 public suffix list update

  - JDK-8244151: Update MUSCLE PC/SC-Lite headers to the latest release 1.8.26

  - JDK-8244164: AArch64: jaotc generates incorrect code for compressed OOPs with non-zero heap base

  - JDK-8244196: adjust output in os_linux

  - JDK-8244225: stringop-overflow warning on strncpy call from compile_the_world_in

  - JDK-8244287: JFR: Methods samples have line number 0

  - JDK-8244703: "platform encoding not initialized" exceptions with debugger, JNI

  - JDK-8244719: CTW: C2 compilation fails with "assert(!VerifyHashTableKeys || _hash_lock == 0) failed: remove node from hash table before modifying it"

  - JDK-8244729: Shenandoah: remove resolve paths from SBSA::generate_shenandoah_lrb

  - JDK-8244763: Update --release 8 symbol information after JSR 337 MR3

  - JDK-8244818: Java2D Queue Flusher crash while moving application window to external monitor

  - JDK-8245151: jarsigner should not raise duplicate warnings on verification

  - JDK-8245616: Bump update version for OpenJDK: jdk-11.0.9

  - JDK-8245714: "Bad graph detected in build_loop_late" when loads are pinned on loop limit check uncommon branch

  - JDK-8245801: StressRecompilation triggers assert "redundunt OSR recompilation detected. memory leak in CodeCache!"

  - JDK-8245832: JDK build make-static-libs should build all JDK libraries

  - JDK-8245880: Shenandoah: check class unloading flag early in concurrent code root scan

  - JDK-8245981: Upgrade to jQuery 3.5.1

  - JDK-8246027: Minimal fastdebug build broken after JDK-8245801

  - JDK-8246094: [macos] Sound Recording and playback is not working

  - JDK-8246153: TestEliminateArrayCopy fails with -XX:+StressReflectiveCode

  - JDK-8246193: Possible NPE in ENC-PA-REP search in AS-REQ

  - JDK-8246196: javax/management/MBeanServer/OldMBeanServerTest fails with AssertionError

  - JDK-8246203: Segmentation fault in verification due to stack overflow with -XX:+VerifyIterativeGVN

  - JDK-8246330: Add TLS Tests for Legacy ECDSA curves

  - JDK-8246453: TestClone crashes with "all collected exceptions must come from the same place"

  - JDK-8247246: Add explicit ResolvedJavaType.link and expose presence of default methods

  - JDK-8247350: [aarch64] assert(false) failed: wrong size of mach node

  - JDK-8247502: PhaseStringOpts crashes while optimising effectively dead code

  - JDK-8247615: Initialize the bytes left for the heap sampler

  - JDK-8247824: CTW: C2 (Shenandoah) compilation fails with SEGV in SBC2Support::pin_and_expand

  - JDK-8247874: Replacement in VersionProps.java.template not working when --with-vendor-bug-url contains '&'

  - JDK-8247979: aarch64: missing side effect of killing flags for clearArray_reg_reg

  - JDK-8248214: Add paddings for TaskQueueSuper to reduce false-sharing cache contention

  - JDK-8248219: aarch64: missing memory barrier in fast_storefield and fast_accessfield

  - JDK-8248348: Regression caused by the update to BCEL 6.0

  - JDK-8248385: [testbug][11u] Adapt TestInitiExceptions to jtreg 5.1

  - JDK-8248495: [macos] zerovm is broken due to libffi headers location

  - JDK-8248851: CMS: Missing memory fences between free chunk check and klass read

  - JDK-8248987: AOT's Linker.java seems to eagerly fail-fast on Windows

  - JDK-8249159: Downport test rework for SSLSocketTemplate from 8224650

  - JDK-8249215: JFrame::setVisible crashed with -Dfile.encoding=UTF-8 on Japanese Windows.

  - JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is not highlighted in GTKLookAndFeel

  - JDK-8249255: Build fails if source code in cygwin home dir

  - JDK-8249277: TestVerifyIterativeGVN.java is failing with timeout in OpenJDK 11

  - JDK-8249278: Revert JDK-8226253 which breaks the spec of AccessibleState.SHOWING for JList

  - JDK-8249560: Shenandoah: Fix racy GC request handling

  - JDK-8249801: Shenandoah: Clear soft-refs on requested GC cycle

  - JDK-8249953: Shenandoah: gc/shenandoah/mxbeans tests should account for corner cases

  - JDK-8250582: Revert Principal Name type to NT-UNKNOWN when requesting TGS Kerberos tickets

  - JDK-8250609: C2 crash in IfNode::fold_compares

  - JDK-8250627: Use -XX:+/-UseContainerSupport for enabling/disabling Java container metrics

  - JDK-8250755: Better cleanup for jdk/test/javax/imageio/plugins/shared/CanWriteSequence.java

  - JDK-8250787: Provider.put no longer registering aliases in FIPS env

  - JDK-8250826: jhsdb does not work with coredump which comes from Substrate VM

  - JDK-8250827: Shenandoah: needs to reset/finish StringTable's dead count before/after parallel walk

  - JDK-8250844: Make sure {type,obj}ArrayOopDesc accessors check the bounds

  - JDK-8251117: Cannot check P11Key size in P11Cipher and P11AEADCipher

  - JDK-8251354: Shenandoah: Fix jdk/jfr/tool/TestPrintJSON.java test failure

  - JDK-8251451: Shenandoah: Remark ObjectSynchronizer roots with I-U

  - JDK-8251469: Better cleanup for test/jdk/javax/imageio/SetOutput.java

  - JDK-8251487: Shenandoah: missing detail timing tracking for final mark cleaning phase

  - JDK-8252120: compiler/oracle/TestCompileCommand.java misspells "occured"

  - JDK-8252157: JDK-8231209 11u backport breaks jmm binary compatibility

  - JDK-8252258: [11u] JDK-8242154 changes the default vendor

  - JDK-8252804: [test] Fix 'ReleaseDeflater.java' test after downport of 8234011

  - JDK-8253134: JMM_VERSION should remain at 0x20020000 (JDK 10) in JDK 11

  - JDK-8253283: [11u] Test build/translations/VerifyTranslations.java failing after JDK-8252258

  - JDK-8253813: Backout JDK-8244287 from 11u: it causes several crashes

Notes on individual issues:

===========================

core-libs/java.nio.charsets:

JDK-8240196: Modified the MS950 charset Encoder's Conversion Table

==================================================================

In this release, some of the one-way byte-to-char mappings have been

aligned with the preferred mappings provided by the Unicode Consortium

(https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit950.txt).

core-libs/java.util:i18n:

JDK-8238914: Localized Time Zone Name Inconsistency Between English and Other Locales

=====================================================================================

English time zone names provided by the CLDR locale provider are now

correctly synthesized following the CLDR spec, rather than substituted

from the COMPAT provider. For example, SHORT style names are no longer

synthesized abbreviations of LONG style names, but instead produce GMT

offset formats.

core-svc/java.lang.management:

JDK-8236876: OperatingSystemMXBean Methods Inside a Container Return Container Specific Data

============================================================================================

When executing in a container, or other virtualized operating

environment, the following `OperatingSystemMXBean` methods in this

release return container specific information, if

available. Otherwise, they return host specific data:

* getFreePhysicalMemorySize()

* getTotalPhysicalMemorySize()

* getFreeSwapSpaceSize()

* getTotalSwapSpaceSize()

* getSystemCpuLoad()

security-libs/java.security:

JDK-8250756: Added Entrust Root Certification Authority - G4 certificate

========================================================================

The Entrust root certificate has been added to the cacerts truststore:

Alias Name: entrustrootcag4

Distinguished Name: CN=Entrust Root Certification Authority - G4, OU="(c) 2015 Entrust,  Inc. - for authorized use only", OU=See www.entrust.net/legal-terms, O="Entrust, Inc.", C=US

JDK-8250860: Added 3 SSL Corporation Root CA Certificates

=========================================================

The following root certificates have been added to the cacerts truststore for the SSL Corporation:

Alias Name: sslrootrsaca

Distinguished Name: CN=SSL.com Root Certification Authority RSA, O=SSL Corporation, L=Houston, ST=Texas, C=US

Alias Name: sslrootevrsaca

Distinguished Name: CN=SSL.com EV Root Certification Authority RSA R2, O=SSL Corporation, L=Houston, ST=Texas, C=US

Alias Name: sslrooteccca

Distinguished Name: CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US

JDK-8236730: Weak Named Curves in TLS, CertPath, and Signed JAR Disabled by Default

===================================================================================

Weak named curves are disabled by default by adding them to the

following `disabledAlgorithms` security properties:

* jdk.tls.disabledAlgorithms

* jdk.certpath.disabledAlgorithms

* jdk.jar.disabledAlgorithms

Red Hat has always disabled many of the curves provided by upstream,

so the only addition in this release is:

* secp256k1

The curves that remain enabled are:

* secp256r1

* secp384r1

* secp521r1

* X25519

* X448

When large numbers of weak named curves need to be disabled, adding

individual named curves to each `disabledAlgorithms` property would be

overwhelming. To relieve this, a new security property,

`jdk.disabled.namedCurves`, is implemented that can list the named

curves common to all of the `disabledAlgorithms` properties. To use

the new property in the `disabledAlgorithms` properties, precede the

full property name with the keyword `include`.  Users can still add

individual named curves to `disabledAlgorithms` properties separate

from this new property.  No other properties can be included in the

`disabledAlgorithms` properties.

To restore the named curves, remove the `include

jdk.disabled.namedCurves` either from specific or from all

`disabledAlgorithms` security properties. To restore one or more

curves, remove the specific named curve(s) from the

`jdk.disabled.namedCurves` property.

JDK-8244286: Tools Warn If Weak Algorithms Are Used Before Restricting Them

===========================================================================

The `keytool` and `jarsigner` tools have been updated to warn users

about weak cryptographic algorithms being used before they are

disabled. In this release, the tools issue warnings for the SHA-1 hash

algorithm and 1024-bit RSA/DSA keys.

security-libs/javax.net.ssl:

JDK-8242147: New System Properties to Configure the TLS Signature Schemes

=========================================================================

Two new system properties have been added to customize the TLS

signature schemes in JDK. `jdk.tls.client.SignatureSchemes` has been

added for the TLS client side, and `jdk.tls.server.SignatureSchemes`

has been added for the server side.

Each system property contains a comma-separated list of supported

signature scheme names specifying the signature schemes that could be

used for the TLS connections.

The names are described in the "Signature Schemes" section of the

*Java Security Standard Algorithm Names Specification*.

security-libs/javax.security:

JDK-8242059: Support for canonicalize in krb5.conf

==================================================

The 'canonicalize' flag in the [krb5.conf file][0] is now supported by

the JDK Kerberos implementation. When set to *true*, RFC 6806 [1] name

canonicalization is requested by clients in TGT requests to KDC

services (AS protocol). Otherwise, and by default, it is not

requested.

The new default behavior is different from previous releases where

name canonicalization was always requested by clients in TGT requests

to KDC services (provided that support for RFC 6806[1] was not

explicitly disabled with the *sun.security.krb5.disableReferrals*

system or security properties).

[0]: https://web.mit.edu/kerberos/krb5-devel/doc/admin/conf_files/krb5_conf.html

[1]: https://tools.ietf.org/html/rfc6806

JDK-8254177: US/Pacific-New Zone name removed as part of tzdata2020b

====================================================================

Following JDK's update to tzdata2020b, the long-obsolete files

pacificnew and systemv have been removed. As a result, the

"US/Pacific-New" zone name declared in the pacificnew data file is no

longer available for use.

Information regarding the update can be viewed at

https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html

New in release OpenJDK 11.0.8 (2020-07-14):

===========================================

Live versions of these release notes can be found at:

  * https://bitly.com/oj1108

  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.8.txt

* Security fixes

  - JDK-8230613: Better ASCII conversions

  - JDK-8231800: Better listing of arrays

  - JDK-8232014: Expand DTD support

  - JDK-8233234: Better Zip Naming

  - JDK-8233239, CVE-2020-14562: Enhance TIFF support

  - JDK-8233255: Better Swing Buttons

  - JDK-8234032: Improve basic calendar services

  - JDK-8234042: Better factory production of certificates

  - JDK-8234418: Better parsing with CertificateFactory

  - JDK-8234836: Improve serialization handling

  - JDK-8236191: Enhance OID processing

  - JDK-8236867, CVE-2020-14573: Enhance Graal interface handling

  - JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior

  - JDK-8237592, CVE-2020-14577: Enhance certificate verification

  - JDK-8238002, CVE-2020-14581: Better matrix operations

  - JDK-8238013: Enhance String writing

  - JDK-8238804: Enhance key handling process

  - JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable

  - JDK-8238843: Enhanced font handing

  - JDK-8238920, CVE-2020-14583: Better Buffer support

  - JDK-8238925: Enhance WAV file playback

  - JDK-8240119, CVE-2020-14593: Less Affine Transformations

  - JDK-8240482: Improved WAV file playback

  - JDK-8241379: Update JCEKS support

  - JDK-8241522: Manifest improved jar headers redux

  - JDK-8242136, CVE-2020-14621: Better XML namespace handling

* Other changes

  - JDK-6933331: (d3d/ogl) java.lang.IllegalStateException: Buffers have not been created

  - JDK-7124307: JSpinner and changing value by mouse

  - JDK-8022574: remove HaltNode code after uncommon trap calls

  - JDK-8039082: [TEST_BUG] Test java/awt/dnd/BadSerializationTest/BadSerializationTest.java fails

  - JDK-8040630: Popup menus and tooltips flicker with previous popup contents when first shown

  - JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining group (OS X 10.9)

  - JDK-8048215: [TESTBUG] java/lang/management/ManagementFactory/ThreadMXBeanProxy.java Expected non-null LockInfo

  - JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails in nightly

  - JDK-8080353: JShell: Better error message on attempting to add default method