Key:

JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X

CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

New in release OpenJDK 11.0.12 (2021-07-20):

=============================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk11012

  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.12.txt

* Security fixes

  - JDK-8256157: Improve bytecode assembly

  - JDK-8256491: Better HTTP transport

  - JDK-8258432, CVE-2021-2341: Improve file transfers

  - JDK-8260453: Improve Font Bounding

  - JDK-8260960: Signs of jarsigner signing

  - JDK-8260967, CVE-2021-2369: Better jar file validation

  - JDK-8262380: Enhance XML processing passes

  - JDK-8262403: Enhanced data transfer

  - JDK-8262410: Enhanced rules for zones

  - JDK-8262477: Enhance String Conclusions

  - JDK-8262967: Improve Zip file support

  - JDK-8264066, CVE-2021-2388: Enhance compiler validation

  - JDK-8264079: Improve abstractions

  - JDK-8264460: Improve NTLM support

* Other changes

  - JDK-6847157: java.lang.NullPointerException: HDC for component at sun.java2d.loops.Blit.Blit

  - JDK-7106851: Test should not use System.exit

  - JDK-8073446: TimeZone getOffset API does not  return a dst offset between years 2038-2137

  - JDK-8076190: Customizing the generation of a PKCS12 keystore

  - JDK-8153005: Upgrade the default PKCS12 encryption/MAC algorithms

  - JDK-8171303: sun/java2d/pipe/InterpolationQualityTest.java fails on Windows & Linux

  - JDK-8177068: incomplete classpath causes NPE in Flow

  - JDK-8185734: [Windows] Structured Exception Catcher missing around gtest execution

  - JDK-8187450: JNI local refs exceeds capacity warning in NetworkInterface::getAll

  - JDK-8190763: Class cast exception on (CompoundEdit) UndoableEditEvent.getEdit()

  - JDK-8195841: PNGImageReader.readNullTerminatedString() doesnt check for non-null terminated strings with length equal to maxLen

  - JDK-8196100: javax/swing/text/JTextComponent/5074573/bug5074573.java fails

  - JDK-8199646: JShell tests: jdk/jshell/FailOverDirectExecutionControlTest.java failed with java.lang.UnsupportedOperationException

  - JDK-8206925: Support the certificate_authorities extension

  - JDK-8207160: ClassReader::adjustMethodParams can potentially return null if the args list is empty

  - JDK-8207247: AARCH64: Enable Minimal and Client VM builds

  - JDK-8207404: MulticastSocket tests failing on AIX

  - JDK-8207779: Method::is_valid_method() compares 'this' with NULL

  - JDK-8208061: runtime/LoadClass/TestResize.java fails with "Load factor too high" when running in CDS mode.

  - JDK-8209459: TestSHA512MultiBlockIntrinsics failed on AArch64

  - JDK-8210443: Migrate Locale matching tests to JDK Repo.

  - JDK-8213231: ThreadSnapshot::_threadObj can become stale

  - JDK-8213483: ARM32: runtime/ErrorHandling/ShowRegistersOnAssertTest.java jtreg test fail

  - JDK-8213725: JShell NullPointerException due to class file with unexpected package

  - JDK-8213794: ARM32: disable TypeProfiling, CriticalJNINatives, Serviceablity tests for ARM32

  - JDK-8213845: ARM32: Interpreter doesn't call result handler after native calls

  - JDK-8214128: ARM32: wrong stack alignment on Deoptimization::unpack_frames

  - JDK-8214512: ARM32: Jtreg test compiler/c2/Test8062950.java fails on ARM

  - JDK-8214854: JDWP: Unforseen output truncation in logging

  - JDK-8214922: Add vectorization support for fmin/fmax

  - JDK-8215009: GCC 8 compilation error in libjli

  - JDK-8216184: CDS/appCDS tests failed on Windows due to long path to a classlist file

  - JDK-8216259: AArch64: Vectorize Adler32 intrinsics

  - JDK-8216314: SIGILL in CodeHeapState::print_names()

  - JDK-8217348: assert(thread->is_Java_thread()) failed: just checking

  - JDK-8217465: [REDO] - Optimize CodeHeap Analytics

  - JDK-8217561: X86: Add floating-point Math.min/max intrinsics

  - JDK-8217918: C2: -XX:+AggressiveUnboxing is broken

  - JDK-8218458: [TESTBUG] runtime/NMT/CheckForProperDetailStackTrace.java fails with Expected stack trace missing from output

  - JDK-8219142: Remove unused JIMAGE_ResourcePath

  - JDK-8219586: CodeHeap State Analytics processes dead nmethods

  - JDK-8220074: Clean up GCC 8.3 errors in LittleCMS

  - JDK-8220407: compiler/intrinsics/math/TestFpMinMaxIntrinsics.java timedout

  - JDK-8222302: [TESTBUG]test/hotspot/jtreg/compiler/intrinsics/sha/cli/TestUseSHAOptionOnUnsupportedCPU.java fails on any other CPU

  - JDK-8222412: AARCH64: multiple instructions encoding issues

  - JDK-8223020: aarch64: expand minI_rReg and maxI_rReg patterns into separate instructions

  - JDK-8223444: Improve CodeHeap Free Space Management

  - JDK-8223504: Improve performance of forall loops by better inlining of "iterator()" methods

  - JDK-8223667: ASAN build broken

  - JDK-8225081: Remove Telia Company CA certificate expiring in April 2021

  - JDK-8225116: Test OwnedWindowsLeak.java intermittently fails

  - JDK-8225438: javax/net/ssl/TLSCommon/TestSessionLocalPrincipal.java failed with Read timed out

  - JDK-8225756: [testbug] compiler/loopstripmining/CheckLoopStripMining.java sets too short a SafepointTimeoutDelay

  - JDK-8226374: Restrict TLS signature schemes and named groups

  - JDK-8226627: assert(t->singleton()) failed: must be a constant

  - JDK-8226721: Missing intrinsics for Math.ceil, floor, rint

  - JDK-8227080: (fs) Files.newInputStream(...).skip(n) is slow

  - JDK-8227222: vmTestbase/jit/FloatingPoint/gen_math/Loops04/Loops04.java failed XMM register should be 0-15

  - JDK-8227609: (fs) Files.newInputStream(...).skip(n) should allow skipping beyond file size

  - JDK-8230428: Cleanup dead CastIP node code in formssel.cpp

  - JDK-8231460: Performance issue (CodeHeap) with large free blocks

  - JDK-8231713: x86_32 build failures after JDK-8226721 (Missing intrinsics for Math.ceil, floor, rint)

  - JDK-8231841: AArch64: debug.cpp help() is missing an AArch64 line for pns

  - JDK-8232084: HotSpot build failed with GCC 9.2.1

  - JDK-8232591: AArch64: Add missing match rules for smaddl, smsubl and smnegl

  - JDK-8233185: HttpServer.stop() blocks indefinitely when called on dispatch thread

  - JDK-8233787: Break cycle in vm_version* includes

  - JDK-8233948: AArch64: Incorrect mapping between OptoReg and VMReg for high 64 bits of Vector Register

  - JDK-8234355: Buffer overflow in jcmd GC.class_stats due to too many classes

  - JDK-8235368: Update BCEL to Version 6.4.1

  - JDK-8236859: WebSocket over authenticating proxy fails with NPE

  - JDK-8236992: AArch64: remove redundant load_klass in itable stub

  - JDK-8237743: test/langtools/jdk/jshell/FailOverExecutionControlTest.java fails No ExecutionControlProvider with name 'nonExistent' and parameter keys: []

  - JDK-8237804: sun/security/mscapi tests fail with "Key pair not generated, alias <nnnnnn> already exists"

  - JDK-8238175: CTW: Class.getDeclaredMethods fails with assert(k->is_subclass_of(SystemDictionary::Throwable_klass())) failed: invalid exception class

  - JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers

  - JDK-8238812: assert(false) failed: bad AD file

  - JDK-8239312: [macos] javax/swing/JFrame/NSTexturedJFrame/NSTexturedJFrame.java

  - JDK-8239386: handle ContendedPaddingWidth in vm_version_aarch64

  - JDK-8239536: Can't use `java.util.List` object after importing `java.awt.List`

  - JDK-8240487: Cleanup whitespace in .cc, .hh, .m, and .mm files

  - JDK-8240848: ArrayIndexOutOfBoundsException buf for TextCallbackHandler

  - JDK-8241082: Upgrade IANA Language Subtag Registry data to 03-16-2020 version

  - JDK-8241087: Build failure with VS 2019 (16.5.0) due to C2039 and C2873

  - JDK-8241101: [s390] jtreg test failure after JDK-8238696: not conformant features string

  - JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)

  - JDK-8241372: Several test failures due to javax.net.ssl.SSLException: Connection reset

  - JDK-8241475: AArch64: Add missing support for PopCountVI node

  - JDK-8241829: Cleanup the code for PrinterJob on windows

  - JDK-8241960: The SHA3 message digests impl of SUN provider are not thread safe after cloned

  - JDK-8242010: Upgrade IANA Language Subtag Registry to Version 2020-04-01

  - JDK-8242429: Better implementation for sign extract

  - JDK-8242557: Add length limit for strings in PNGImageWriter

  - JDK-8242919: Paste locks up jshell

  - JDK-8243155: AArch64: Add support for SqrtVF

  - JDK-8243240: AArch64: Add support for MulVB

  - JDK-8243452: JFR: Could not create chunk in repository with over 200 recordings

  - JDK-8243559: Remove root certificates with 1024-bit keys

  - JDK-8243597: AArch64: Add support for integer vector abs

  - JDK-8244031: HttpClient should have more tests for HEAD requests

  - JDK-8244205: HTTP/2 tunnel connections through proxy may be reused regardless of which proxy is selected

  - JDK-8244847: Linux/PPC: runtime/CompressedOops/CompressedClassPointers: smallHeapTest fails

  - JDK-8245511: G1 adaptive IHOP does not account for reclamation of humongous objects by young GC

  - JDK-8246274: G1 old gen allocation tracking is not in a separate class

  - JDK-8247354: [aarch64] PopFrame causes assert(oopDesc::is_oop(obj)) failed: not an oop

  - JDK-8247408: IdealGraph bit check expression canonicalization

  - JDK-8247432: Update IANA Language Subtag Registry to Version 2020-09-29

  - JDK-8247438: JShell: When FailOverExecutionControlProvider fails the proximal cause is not shown

  - JDK-8247753: UIManager.getSytemLookAndFeelClassName() returns wrong value on Fedora 32

  - JDK-8248043: Need to eliminate excessive i2l conversions

  - JDK-8248411: [aarch64] Insufficient error handling when CodeBuffer is exhausted

  - JDK-8248568: compiler/c2/TestBit.java failed: test missing from stdout/stderr

  - JDK-8248870: AARCH64: I2L/L2I conversions can be skipped for masked positive values

  - JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is unstable

  - JDK-8249189: AARCH64: more L2I conversions can be skipped

  - JDK-8249719: MethodHandle performance suffers from bad ResolvedMethodTable hash function

  - JDK-8249875: GCC 10 warnings -Wtype-limits with JFR code

  - JDK-8250635: MethodArityHistogram should use Compile_lock in favour of fancy checks

  - JDK-8250876: Fix issues with cross-compile on macos

  - JDK-8251031: Some vmTestbase/nsk/monitoring/RuntimeMXBean tests fail with hostnames starting from digits

  - JDK-8251525: AARCH64: Faster Math.signum(fp)

  - JDK-8252259: AArch64: Adjust default value of FLOATPRESSURE

  - JDK-8252311: AArch64: save two words in itable lookup stub

  - JDK-8252779: compiler/graalunit/HotspotTest.java failed after 8251525

  - JDK-8252883: AccessDeniedException caused by delayed file deletion on Windows

  - JDK-8253167: ARM32 builds fail after JDK-8247910

  - JDK-8253572: [windows] CDS archive may fail to open with long file names

  - JDK-8253923: C2 doesn't always run loop opts for compilations that include loops

  - JDK-8253948: Memory leak in ImageFileReader

  - JDK-8254631: Better support ALPN byte wire values in SunJSSE

  - JDK-8254717: isAssignableFrom checks in KeyFactorySpi.engineGetKeySpec appear to be backwards

  - JDK-8255086: Update the root locale display names

  - JDK-8255625: AArch64: Implement Base64.encodeBlock accelerator/intrinsic

  - JDK-8255763: C2: OSR miscompilation caused by invalid memory instruction placement

  - JDK-8255992: JFR EventWriter does not use first string from StringPool with id 0

  - JDK-8256037: [TESTBUG] com/sun/jndi/dns/ConfigTests/PortUnreachable.java fails due to the hard coded threshold is small

  - JDK-8256244: java/lang/ProcessHandle/PermissionTest.java fails with TestNG 7.1

  - JDK-8256287: [windows] add loop fuse to map_or_reserve_memory_aligned

  - JDK-8256523: Streamline Java SHA2 implementation

  - JDK-8257414: Drag n Drop target area is wrong on high DPI systems

  - JDK-8257569: Failure observed with JfrVirtualMemory::initialize

  - JDK-8257574: C2: "failed: parsing found no loops but there are some" assert failure

  - JDK-8257580: Bump update version for OpenJDK: jdk-11.0.12

  - JDK-8257604: JNI_ArgumentPusherVaArg leaks valist

  - JDK-8257621: JFR StringPool misses cached items across consecutive recordings

  - JDK-8257796: [TESTBUG] TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on x86_32

  - JDK-8257822: C2 crashes with SIGFPE due to a division that floats above its zero check

  - JDK-8257828: SafeFetch may crash if invoked in non-JavaThreads

  - JDK-8257853: Remove dependencies on JNF's JNI utility functions in AWT and 2D code

  - JDK-8257858: [macOS]: Remove JNF dependency from libosxsecurity/KeystoreImpl.m

  - JDK-8257860: [macOS]: Remove JNF dependency from libosxkrb5/SCDynamicStoreConfig.m

  - JDK-8257988: Remove JNF dependency from libsaproc/MacosxDebuggerLocal.m

  - JDK-8258414: OldObjectSample events too expensive

  - JDK-8258505: [TESTBUG] TestDivZeroWithSplitIf.java fails due to missing UnlockDiagnosticVMOptions

  - JDK-8258753: StartTlsResponse.close() hangs due to synchronization issues

  - JDK-8259061: C2: assert(found) failed: memory-writing node is not placed in its original loop or an ancestor of it

  - JDK-8259227: C2 crashes with SIGFPE due to a division that floats above its zero check

  - JDK-8259232: Bad JNI lookup during printing

  - JDK-8259276: C2: Empty expression stack when reexecuting tableswitch/lookupswitch instructions after deoptimization

  - JDK-8259343: [macOS] Update JNI error handling in Cocoa code.

  - JDK-8259585: Accessible actions do not work on mac os x

  - JDK-8259651: [macOS] Replace JNF_COCOA_ENTER/EXIT macros

  - JDK-8259662: Don't wrap SocketExceptions into SSLExceptions in SSLSocketImpl

  - JDK-8259710: Inlining trace leaks memory

  - JDK-8259729: Missed JNFInstanceOf -> IsInstanceOf conversion

  - JDK-8259777: Incorrect predication condition generated by ADLC

  - JDK-8259786: initialize last parameter of getpwuid_r

  - JDK-8259843: initialize dli_fname array before calling dll_address_to_library_name

  - JDK-8259869: [macOS] Remove desktop module dependencies on JNF Reference APIs

  - JDK-8259886: Improve SSL session cache performance and scalability

  - JDK-8259983: do not use uninitialized expand_ms value in G1CollectedHeap::expand_heap_after_young_collection

  - JDK-8260030: Improve stringStream buffer handling

  - JDK-8260236: better init AnnotationCollector _contended_group

  - JDK-8260255: C1: LoopInvariantCodeMotion constructor can leave some fields uninitialized

  - JDK-8260284: C2: assert(_base == Int) failed: Not an Int

  - JDK-8260380: Upgrade to LittleCMS 2.12

  - JDK-8260420: C2 compilation fails with assert(found_sfpt) failed: no node in loop that's not input to safepoint

  - JDK-8260426: awt debug_mem.c DMem_AllocateBlock might leak memory

  - JDK-8260432: allocateSpaceForGP in freetypeScaler.c might leak memory

  - JDK-8260616: Removing remaining JNF dependencies in the java.desktop module

  - JDK-8260653: Unreachable nodes keep speculative types alive

  - JDK-8260707: java/lang/instrument/PremainClass/InheritAgent0100.java times out

  - JDK-8260925: HttpsURLConnection does not work  with other JSSE provider.

  - JDK-8260926: Trace resource exhausted events unconditionally

  - JDK-8261020: Wrong format parameter in create_emergency_chunk_path

  - JDK-8261027: AArch64: Support for LSE atomics C++ HotSpot code

  - JDK-8261167: print_process_memory_info add a close call after fopen

  - JDK-8261170: Upgrade to freetype 2.10.4

  - JDK-8261198: [macOS] Incorrect JNI parameters in number conversion in A11Y code

  - JDK-8261235: C1 compilation fails with assert(res->vreg_number() == index) failed: conversion check

  - JDK-8261261: The version extra fields needs to be overridable in jib-profiles.js

  - JDK-8261262: Kitchensink24HStress.java crashed with EXCEPTION_ACCESS_VIOLATION

  - JDK-8261354: SIGSEGV at MethodIteratorHost

  - JDK-8261355: No data buffering in SunPKCS11 Cipher encryption when the underlying mechanism has no padding

  - JDK-8261397: try catch Method failing to work when dividing an integer by 0

  - JDK-8261422: Adjust problematic String.format calls in jdk/internal/util/Preconditions.java outOfBoundsMessage

  - JDK-8261447: MethodInvocationCounters frequently run into overflow

  - JDK-8261481: Cannot read Kerberos settings in dynamic store on macOS Big Sur

  - JDK-8261505: Test test/hotspot/jtreg/gc/parallel/TestDynShrinkHeap.java killed by Linux OOM Killer

  - JDK-8261601: free memory in early return in Java_sun_nio_ch_sctp_SctpChannelImpl_receive0

  - JDK-8261649: AArch64: Optimize LSE atomics in C++ code

  - JDK-8261730: C2 compilation fails with assert(store->find_edge(load) != -1) failed: missing precedence edge

  - JDK-8261752: Multiple GC test are missing memory requirements

  - JDK-8261791: (sctp) handleSendFailed in SctpChannelImpl.c potential leaks

  - JDK-8261812: C2 compilation fails with assert(!had_error) failed: bad dominance

  - JDK-8261914: IfNode::fold_compares_helper faces non-canonicalized bool when running JRuby JSON workload

  - JDK-8262093: java/util/concurrent/tck/JSR166TestCase.java failed "assert(false) failed: unexpected node"

  - JDK-8262110: DST starts from incorrect time in 2038

  - JDK-8262121: [11u] Redo 8244287: JFR: Methods samples have line number 0

  - JDK-8262163: Extend settings printout in jcmd VM.metaspace

  - JDK-8262295: C2: Out-of-Bounds Array Load from Clone Source

  - JDK-8262298: G1BarrierSetC2::step_over_gc_barrier fails with assert "bad barrier shape"

  - JDK-8262446: DragAndDrop hangs on Windows

  - JDK-8262461: handle wcstombsdmp return value correctly in unix awt_InputMethod.c

  - JDK-8262465: Very long compilation times and high memory consumption in C2 debug builds

  - JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt stack

  - JDK-8262739: String inflation C2 intrinsic prevents insertion of anti-dependencies

  - JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()

  - JDK-8262837: handle split_USE correctly

  - JDK-8262900: ToolBasicTest fails to access HTTP server it starts

  - JDK-8263260: [s390] Support latest hardware (z14 and z15)

  - JDK-8263311: Watch registry changes for remote printers update instead of polling

  - JDK-8263361: Incorrect arraycopy stub selected by C2 for SATB collectors

  - JDK-8263404: RsaPrivateKeySpec is always recognized as RSAPrivateCrtKeySpec in RSAKeyFactory.engineGetKeySpec

  - JDK-8263425: AArch64: two potential bugs in C1 LIRGenerator::generate_address()

  - JDK-8263448: CTW: fatal error: meet not symmetric

  - JDK-8263504: Some OutputMachOpcodes fields are uninitialized

  - JDK-8263557: Possible NULL dereference in Arena::destruct_contents()

  - JDK-8263558: Possible NULL dereference in fast path arena free if ZapResourceArea is true

  - JDK-8263676: AArch64: one potential bug in C1 LIRGenerator::generate_address()

  - JDK-8263729: [test] divert spurious output away from stream under test in ProcessBuilder Basic test

  - JDK-8263846: Bad JNI lookup getFocusOwner in accessibility code on Mac OS X

  - JDK-8264047: Duplicate global variable 'jvm' in libjavajpeg and libawt

  - JDK-8264096: slowdebug jvm crashes when StrInflatedCopy match rule is not supported

  - JDK-8264151: ciMethod::ensure_method_data() should return false is loading resulted in empty state

  - JDK-8264173: [s390] Improve Hardware Feature Detection And Reporting

  - JDK-8264190: Harden TLS interop tests

  - JDK-8264223: CodeHeap::verify fails extra_hops assertion in fastdebug test

  - JDK-8264328: Broken license in javax/swing/JComboBox/8072767/bug8072767.java

  - JDK-8264360: Loop strip mining verification fails with "should be on the backedge"

  - JDK-8264626: C1 should be able to inline excluded methods

  - JDK-8264640: CMS ParScanClosure misses a barrier

  - JDK-8264786: [macos] All Swing/AWT apps cause Allow Notifications prompt to appear when app is launched

  - JDK-8264821: DirectIOTest fails on a system with large block size

  - JDK-8264848: [macos] libjvm.dylib linker warning due to macOS version mismatch

  - JDK-8264923: PNGImageWriter.write_zTXt throws Exception with a typo

  - JDK-8264958: C2 compilation fails with assert "n is later than its clone"

  - JDK-8265099: Revert backport to 11u of 8236859: WebSocket over authenticating proxy fails with NPE

  - JDK-8265154: vinserti128 operand mix up for KNL platforms

  - JDK-8265239: Shenandoah: Shenandoah heap region count could be off by 1

  - JDK-8265417: Backport of JDK-8249672 breaks Solaris x86 build

  - JDK-8265421: java/lang/String/StringRepeat.java test is missing a memory requirement

  - JDK-8265462: Handle multiple slots in the NSS Internal Module from SunPKCS11's Secmod

  - JDK-8265537: x86 version string truncated after JDK-8249672 11u backport

  - JDK-8265666: Enable AIX build platform to make external debug symbols

  - JDK-8265677: CMS: CardTableBarrierSet::write_ref_array_work() lacks storestore barrier

  - JDK-8265690: Use the latest Ubuntu base image version in Docker testing

  - JDK-8265718: Build failure after JDK-8258414 11u backport

  - JDK-8265750: Fatal error in safepoint.cpp after backport of 8258414

  - JDK-8265784: [C2] Hoisting of DecodeN leaves MachTemp inputs behind

  - JDK-8265938: C2's conditional move optimization does not handle top Phi

  - JDK-8266220: keytool still prompt for store password on a password-less pkcs12 file if -storetype pkcs12 is specified

  - JDK-8266293: Key protection using PBEWithMD5AndDES fails with "java.security.InvalidAlgorithmParameterException: Salt must be 8 bytes long"

  - JDK-8266713: [AIX] Build failure after 11u backport of JDK-8247753

  - JDK-8266802: Shenandoah: Round up region size to page size unconditionally

  - JDK-8266892: avoid maybe-uninitialized gcc warnings on linux s390x

  - JDK-8266929: Unable to use algorithms from 3p providers

  - JDK-8267235: [macos_aarch64] InterpreterRuntime::throw_pending_exception messing up LR results in crash

  - JDK-8267561: Shenandoah: Reference processing not properly setup for outside of cycle degenerated GC

  - JDK-8267599: Revert the change to the default PKCS12 macAlgorithm and macIterationCount props for 11u/8u/7u

  - JDK-8267641: [11u] 8227609 backport typo

  - JDK-8267721: Enable sun/security/pkcs11 tests for Amazon Linux 2 AArch64

  - JDK-8268678: LetsEncryptCA.java test fails as Let’s Encrypt Authority X3 is retired

Notes on individual issues:

===========================

security-libs/java.security:

JDK-8215293: Customizing PKCS12 keystore Generation

===================================================

New system and security properties have been added to enable users to

customize the generation of PKCS #12 keystores. This includes

algorithms and parameters for key protection, certificate protection,

and MacData. The detailed explanation and possible values for these

properties can be found in the "PKCS12 KeyStore properties" section of

the `java.security` file.

Also, support for the following SHA-2 based HmacPBE algorithms has

been added to the SunJCE provider:

* HmacPBESHA224

* HmacPBESHA256

* HmacPBESHA384

* HmacPBESHA512

* HmacPBESHA512/224

* HmacPBESHA512/256

JDK-8256902: Removed Root Certificates with 1024-bit Keys

=========================================================

The following root certificates with weak 1024-bit RSA public keys

have been removed from the `cacerts` keystore:

Alias Name: thawtepremiumserverca [jdk]

Distinguished Name: EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA

Alias Name: verisignclass2g2ca [jdk]

Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 2 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

Alias Name: verisignclass3ca [jdk]

Distinguished Name: OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US

Alias Name: verisignclass3g2ca [jdk]

Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For authorized use only", OU=Class 3 Public Primary Certification Authority - G2, O="VeriSign, Inc.", C=US

Alias Name: verisigntsaca [jdk]

Distinguished Name: CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA

JDK-8261361: Removed Telia Company's Sonera Class2 CA certificate

=================================================================

The following root certificate have been removed from the cacerts truststore:

Alias Name: soneraclass2ca

Distinguished Name: CN=Sonera Class2 CA, O=Sonera, C=FI

JDK-8242069: Upgraded the Default PKCS12 Encryption and MAC Algorithms

======================================================================

The default encryption and MAC algorithms used in a PKCS #12 keystore

have been updated. The new algorithms are based on AES-256 and SHA-256

and are stronger than the old algorithms that were based on RC2,

DESede, and SHA-1. See the security properties starting with

`keystore.pkcs12` in the `java.security` file for detailed

information.

For compatibility, a new system property named

`keystore.pkcs12.legacy` is defined that will revert the algorithms to

use the older, weaker algorithms. There is no value defined for this

property.

security-libs/javax.net.ssl:

JDK-8257548: Improve Encoding of TLS Application-Layer Protocol Negotiation (ALPN) Values

=========================================================================================

Certain TLS ALPN values couldn't be properly read or written by the

SunJSSE provider. This is due to the choice of Strings as the API

interface and the undocumented internal use of the UTF-8 Character Set

which converts characters larger than U+00007F (7-bit ASCII) into

multi-byte arrays that may not be expected by a peer.

ALPN values are now represented using the network byte representation

expected by the peer, which should require no modification for

standard 7-bit ASCII-based character Strings. However, SunJSSE now

encodes/decodes String characters as 8-bit ISO_8859_1/LATIN-1

characters.  This means applications that used characters above

U+000007F that were previously encoded using UTF-8 may need to either

be modified to perform the UTF-8 conversion, or set the Java security

property `jdk.tls.alpnCharset` to "UTF-8" revert the behavior.

See the updated guide at

https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/alpn.html

for more information.

JDK-8244460: Support for certificate_authorities Extension

==========================================================

The "certificate_authorities" extension is an optional extension

introduced in TLS 1.3. It is used to indicate the certificate

authorities (CAs) that an endpoint supports and should be used by the

receiving endpoint to guide certificate selection.

With this JDK release, the "certificate_authorities" extension is

supported for TLS 1.3 in both the client and the server sides.  This

extension is always present for client certificate selection, while it

is optional for server certificate selection.

Applications can enable this extension for server certificate

selection by setting the `jdk.tls.client.enableCAExtension` system

property to `true`.  The default value of the property is `false`.

Note that if the client trusts more CAs than the size limit of the

extension (less than 2^16 bytes), the extension is not enabled.  Also,

some server implementations do not allow handshake messages to exceed

2^14 bytes.  Consequently, there may be interoperability issues when

`jdk.tls.client.enableCAExtension` is set to `true` and the client

trusts more CAs than the server implementation limit.

New in release OpenJDK 11.0.11 (2021-04-20):

=============================================

Live versions of these release notes can be found at:

  * https://bitly.com/openjdk11011

  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.11.txt

* Security fixes

  - JDK-8244473: Contextualize registration for JNDI

  - JDK-8244543: Enhanced handling of abstract classes

  - JDK-8249906, CVE-2021-2163: Enhance opening JARs

  - JDK-8250568, CVE-2021-2161: Less ambiguous processing

  - JDK-8253799: Make lists of normal filenames

  - JDK-8257001: Improve Http Client Support

* Other changes

  - JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream readDouble() conversion to long mishandled

  - JDK-7146776: deadlock between URLStreamHandler.getHostAddress and file.Handler.openconnection

  - JDK-8086003: Test fails on OSX with java.lang.RuntimeException 'Narrow klass base: 0x0000000000000000, Narrow klass shift: 3' missing

  - JDK-8168869: jdeps: localized messages don't use proper line breaks

  - JDK-8180837: SunPKCS11-NSS tests failing with CKR_ATTRIBUTE_READ_ONLY and CKR_MECHANISM_PARAM_INVALID

  - JDK-8202343: Disable TLS 1.0 and 1.1

  - JDK-8205992: jhsdb cannot attach to Java processes running in Docker containers

  - JDK-8209193: Fix aarch64-linux compilation after -Wreorder changes

  - JDK-8210413: AArch64: Optimize div/rem by constant in C1

  - JDK-8210578: AArch64: Invalid encoding for fmlsvs instruction

  - JDK-8211051: jdeps usage of --dot-output doesn't provide valid output for modular jar

  - JDK-8211057: Gensrc step CompileProperties generates unstable CompilerProperties output

  - JDK-8211150: G1 Full GC not purging code root memory and hence causing memory leak

  - JDK-8211825: ModuleLayer.defineModulesWithXXX does not setup delegation when module reads automatic module

  - JDK-8212043: Add floating-point Math.min/max intrinsics

  - JDK-8212218: [TESTBUG] runtime/ErrorHandling/TestHeapDumpOnOutOfMemoryErrorInMetaspace.java timed out

  - JDK-8213116: javax/swing/JComboBox/WindowsComboBoxSize/WindowsComboBoxSizeTest.java fails in Windows

  - JDK-8213909: jdeps --print-module-deps should report missing dependences

  - JDK-8214180: Need better granularity for sleeping

  - JDK-8214223: tools/jdeps/listdeps/ListModuleDeps.java failed due to missing Lib2 file

  - JDK-8214230: Classes generated by SystemModulesPlugin.java are not reproducable

  - JDK-8214741: docs/index.html has no title or copyright

  - JDK-8215687: [Graal] unit test CheckGraalIntrinsics failed after 8212043

  - JDK-8217848: [Graal] vmTestbase/nsk/jvmti/ResourceExhausted/resexhausted003/TestDescription.java fails

  - JDK-8218482: sun/security/krb5/auto/ReplayCachePrecise.java failed - no KrbException thrown

  - JDK-8218550: Add test omitted from JDK-8212043

  - JDK-8221584: SIGSEGV in os::PlatformEvent::unpark() in JvmtiRawMonitor::raw_exit while posting method exit event

  - JDK-8221995: AARCH64: problems with CAS instructions encoding

  - JDK-8222518: Remove unnecessary caching of Parker object in java.lang.Thread

  - JDK-8222785: aarch64: add necessary masking for immediate shift counts

  - JDK-8223186: HotSpot compile warnings from GCC 9

  - JDK-8225773: jdeps --check produces NPE if there are missing module dependences

  - JDK-8225805: Java Access Bridge does not close the logger

  - JDK-8226810: Failed to launch JVM because of NullPointerException occured on System.props

  - JDK-8229396: jdeps ignores multi-release when generate-module-info used on command line

  - JDK-8229474: Shenandoah: Cleanup CM::update_roots()

  - JDK-8232225: Rework the fix for JDK-8071483

  - JDK-8232905: JFR fails with assertion: assert(t->unflushed_size() == 0) failed: invariant

  - JDK-8233164: C2 fails with assert(phase->C->get_alias_index(t) == phase->C->get_alias_index(t_adr)) failed: correct memory chain

  - JDK-8233910: java/awt/ColorClass/AlphaColorTest.java is failing intermittently in nightly lnux-x64 system

  - JDK-8233912: aarch64: minor improvements of atomic operations

  - JDK-8234508: VM_HeapWalkOperation::iterate_over_object reads non-strong fields with an on-strong load barrier

  - JDK-8234742: Improve handshake logging

  - JDK-8234796: Refactor Handshake::execute to take a more complex type than ThreadClosure

  - JDK-8235324: Dying objects are published from users of CollectedHeap::object_iterate

  - JDK-8235351: Lookup::unreflect should bind with the original caller independent of Method's accessible flag

  - JDK-8237369: Shenandoah: failed vmTestbase/nsk/jvmti/AttachOnDemand/attach021/TestDescription.java test

  - JDK-8237392: Shenandoah: Remove unreliable assertion

  - JDK-8237483: AArch64 C1 OopMap inserted twice fatal error

  - JDK-8237495: Java MIDI fails with a dereferenced memory error when asked to send a raw 0xF7

  - JDK-8239355: (dc) Initial value of SO_SNDBUF should allow sending large datagrams (macOS)

  - JDK-8240353: AArch64: missing support for -XX:+ExtendedDTraceProbes in C1

  - JDK-8240704: CheckHandles.java failed "AssertionError: Handle use increased by more than 10 percent."

  - JDK-8240751: Shenandoah: fold ShenandoahTracer definition

  - JDK-8240795: [REDO] 8238384 CTW: C2 compilation fails with "assert(store != load->find_exact_control(load->in(0))) failed: dependence cycle found"

  - JDK-8241598: Upgrade JLine to 3.14.0

  - JDK-8241649: Optimize Character.toString

  - JDK-8241770: Module xxxAnnotation() methods throw NCDFE if module-info.class found as resource in unnamed module

  - JDK-8241911: AArch64: Fix a potential register clash issue in reduce_add2I

  - JDK-8242030: Wrong package declarations in jline classes after JDK-8241598

  - JDK-8242565: Policy initialization issues when the denyAfter constraint is enabled

  - JDK-8243618: compiler/rtm/cli tests can be run w/o WhiteBox

  - JDK-8243670: Unexpected test result caused by C2 MergeMemNode::Ideal

  - JDK-8244088: [Regression] Switch of Gnome theme ends up in deadlocked UI

  - JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header files

  - JDK-8244340: Handshake processing thread lacks yielding

  - JDK-8244573: java.lang.ArrayIndexOutOfBoundsException thrown for malformed class file

  - JDK-8244683: A TSA server used by tests

  - JDK-8245005: javax/net/ssl/compatibility/BasicConnectTest.java failed with No enum constant

  - JDK-8245026: PsAdaptiveSizePolicy::_old_gen_policy_is_ready is unused

  - JDK-8245283: JFR: Can't handle constant dynamic used by Jacoco agent

  - JDK-8245512: CRC32 optimization using AVX512 instructions

  - JDK-8245527: LDAP Channel Binding support for Java GSS/Kerberos

  - JDK-8246707: (sc) SocketChannel.read/write throws AsynchronousCloseException on closed channel

  - JDK-8246709: sun/security/tools/jarsigner/TsacertOptionTest.java compilation failed after JDK-8244683

  - JDK-8247200: assert((unsigned)fpargs < 32)

  - JDK-8247766: [aarch64] guarantee(val < (1U << nbits)) failed: Field too big for insn.

  - JDK-8248336: AArch64: C2: offset overflow in BoxLockNode::emit

  - JDK-8248865: Document JNDI/LDAP timeout properties

  - JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.

  - JDK-8249543: Force DirectBufferAllocTest to run with -ExplicitGCInvokesConcurrent

  - JDK-8249588: libwindowsaccessbridge issues on 64bit Windows

  - JDK-8249749: modify a primitive array through a stream and a for cycle causes jre crash

  - JDK-8249787: Make TestGCLocker more resilient with concurrent GCs

  - JDK-8249867: xml declaration is not followed by a newline

  - JDK-8250911: [windows] os::pd_map_memory() error detection broken

  - JDK-8251255: [linux] Add process-memory information to hs-err and VM.info

  - JDK-8251359: Shenandoah: filter null oops before calling enqueue/SATB barrier

  - JDK-8251925: C2: RenaissanceStressTest fails with assert(!had_error): bad dominance

  - JDK-8251944: Add Shenandoah test config to compiler/gcbarriers/UnsafeIntrinsicsTest.java

  - JDK-8251992: VM crashed running TestComplexAddrExpr.java test with -XX:UseAVX=X

  - JDK-8253220: Epsilon: clean up unused code/declarations

  - JDK-8253274: The CycleDMImagetest brokes the system

  - JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node

  - JDK-8253368: TLS connection always receives close_notify exception

  - JDK-8255368: Math.exp() gives wrong result for large values on x86 32-bit platforms

  - JDK-8255401: Shenandoah: Allow oldval and newval registers to overlap in cmpxchg_oop()

  - JDK-8253404: C2: assert(C->live_nodes() <= C->max_node_limit()) failed: Live Node limit exceeded limit

  - JDK-8253409: Double-rounding possibility in float fma

  - JDK-8253476: TestUseContainerSupport.java fails on some Linux kernels w/o swap limit capabilities

  - JDK-8253524: C2: Refactor code that clones predicates during loop unswitching

  - JDK-8253644: C2: assert(skeleton_predicate_has_opaque(iff)) failed: unexpected

  - JDK-8253681: closed java/awt/dnd/MouseEventAfterStartDragTest/MouseEventAfterStartDragTest.html test failed

  - JDK-8253702: BigSur version number reported as 10.16, should be 11.nn

  - JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)

  - JDK-8254104: MethodCounters must exist before nmethod is installed

  - JDK-8254734: "dead loop detected" assert failure with patch from 8223051

  - JDK-8254748: Bad Copyright header format after JDK-8212218

  - JDK-8254799: runtime/ErrorHandling/TestHeapDumpOnOutOfMemoryError.java fails with release VMs

  - JDK-8255058: C1: assert(is_virtual()) failed: type check

  - JDK-8255351: Add detection for Graviton 2 CPUs

  - JDK-8255387: Japanese characters were printed upside down on AIX

  - JDK-8255479: [aarch64] assert(src->section_index_of(target) == CodeBuffer::SECT_NONE) failed: sanity

  - JDK-8255544: Create a checked cast

  - JDK-8255559: Leak File Descriptors Because of ResolverLocalFilesystem#engineResolveURI()

  - JDK-8255681: print callstack in error case in runAWTLoopWithApp

  - JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too

  - JDK-8255742: PrintInlining as compiler directive doesn't print virtual calls

  - JDK-8255845: Memory leak in imageFile.cpp

  - JDK-8255880: UI of Swing components is not redrawn after their internal state changed

  - JDK-8255908: ExceptionInInitializerError due to UncheckedIOException while initializing cgroupv1 subsystem

  - JDK-8256025: AArch64: MachCallRuntimeNode::ret_addr_offset() is incorrect for stub calls

  - JDK-8256056: Deoptimization stub doesn't save vector registers on x86

  - JDK-8256061: RegisterSaver::save_live_registers() omits upper halves of ZMM0-15 registers

  - JDK-8256187: [TEST_BUG] Automate bug4275046.java test

  - JDK-8256220: C1: x86_32 fails with -XX:UseSSE=1 after JDK-8210764 due to mishandled lir_neg

  - JDK-8256258: some missing NULL checks or asserts after CodeCache::find_blob_unsafe

  - JDK-8256264: Printed GlyphVector outline with low DPI has bad quality on Windows

  - JDK-8256290: javac/lambda/T8031967.java fails with StackOverflowError on x86_32

  - JDK-8256359: AArch64: runtime/ReservedStack/ReservedStackTestCompiler.java fails

  - JDK-8256387: Unexpected result if patching an entire instruction on AArch64

  - JDK-8256421: Add 2 HARICA roots to cacerts truststore

  - JDK-8256488: [aarch64] Use ldpq/stpq instead of ld4/st4 for small copies in StubGenerator::copy_memory

  - JDK-8256489: Make gtest for long path names on Windows more resilient in the presence of virus scanners

  - JDK-8256501: libTestMainKeyWindow fails to build with Xcode 12.2

  - JDK-8256633: Fix product build on Windows+Arm64

  - JDK-8256682: JDK-8202343 is incomplete

  - JDK-8256751: Incremental rebuild with precompiled header fails when touching a header file

  - JDK-8256757: Incorrect MachCallRuntimeNode::ret_addr_offset() for CallLeafNoFP on x86_32

  - JDK-8256806: Shenandoah: optimize shenandoah/jni/TestPinnedGarbage.java test

  - JDK-8256807: C2: Not marking stores correctly as mismatched in string opts

  - JDK-8256810: Incremental rebuild broken on Macosx

  - JDK-8256818: SSLSocket that is never bound or connected leaks socket resources

  - JDK-8256888: Client manual test problem list update

  - JDK-8257083: Security infra test failures caused by JDK-8202343

  - JDK-8257408: Bump update version for OpenJDK: jdk-11.0.11

  - JDK-8257423: [PPC64] Support -XX:-UseInlineCaches

  - JDK-8257436: [aarch64] Regressions in ArrayCopyUnalignedDst.testByte/testChar for 65-78 bytes when UseSIMDForMemoryOps is on

  - JDK-8257513: C2: assert((constant_addr - _masm.code()->consts()->start()) == con.offset())

  - JDK-8257547: Handle multiple prereqs on the same line in deps files

  - JDK-8257561: Some code is not vectorized after 8251925 and 8250607

  - JDK-8257565: epsilonBarrierSet.hpp should not include barrierSetAssembler

  - JDK-8257575: C2: "failed: only phis" assert failure in loop strip mining verification

  - JDK-8257594: C2 compiled checkcast of non-null object triggers endless deoptimization/recompilation cycle

  - JDK-8257633: Missing -mmacosx-version-min=X flag when linking libjvm

  - JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java reports leaks

  - JDK-8257707: Fix incorrect format string in Http1HeaderParser

  - JDK-8257746: Regression introduced with JDK-8250984 - memory might be null in some machines

  - JDK-8257798: [PPC64] undefined reference to Klass::vtable_start_offset()

  - JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java as automatic test

  - JDK-8257910: [JVMCI] Set exception_seen accordingly in the runtime.

  - JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java again reports leaks after JDK-8257884

  - JDK-8257999: Parallel GC crash in gc/parallel/TestDynShrinkHeap.java: new region is not in covered_region

  - JDK-8258077: Using -Xcheck:jni can lead to a double-free after JDK-8193234

  - JDK-8258247: Couple of issues in fix for JDK-8249906

  - JDK-8258373: Update the text handling in the JPasswordField

  - JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder.rotateDisk()

  - JDK-8258419: RSA cipher buffer cleanup

  - JDK-8258471: "search codecache" clhsdb command does not work

  - JDK-8258534: Epsilon: clean up unused includes

  - JDK-8258805: Japanese characters not entered by mouse click on Windows 10

  - JDK-8258833: Cancel multi-part cipher operations in SunPKCS11 after failures

  - JDK-8258836: JNI local refs exceed capacity getDiagnosticCommandInfo

  - JDK-8258884: [TEST_BUG] Convert applet-based test open/test/jdk/javax/swing/JMenuItem/8031573/bug8031573.java to a regular java test

  - JDK-8259007: This test printed a blank page

  - JDK-8259049: Uninitialized variable after JDK-8257513

  - JDK-8259451: Zero: skip serviceability/sa tests, set vm.hasSA to false

  - JDK-8259580: Shenandoah: uninitialized label in VerifyThreadGCState

  - JDK-8259231: Epsilon: improve performance under contention during virtual space expansion

  - JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails "assert(covered_region.contains(new_memregion)) failed: new region is not in covered_region"

  - JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will expire in 90 days

  - JDK-8259319: Illegal package access when SunPKCS11 requires SunJCE's classes

  - JDK-8259339: AllocateUninitializedArray C2 intrinsic fails with void.class input

  - JDK-8259428: AlgorithmId.getEncodedParams() should return copy

  - JDK-8259446: runtime/jni/checked/TestCheckedReleaseArrayElements.java fails with stderr not empty

  - JDK-8259949: x86 32-bit build fails when -fcf-protection is passed in the compiler flags

  - JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use condition is incorrect

  - JDK-8259633: compiler/graalunit/CoreTest.java fails with NPE after JDK-8244543

  - JDK-8259706: C2 compilation fails with assert(vtable_index == Method::invalid_vtable_index) failed: correct sentinel value

  - JDK-8259707: LDAP channel binding does not work with StartTLS extension

  - JDK-8259773: Incorrect encoding of AVX-512 kmovq instruction

  - JDK-8259849: Shenandoah: Rename store-val to IU-barrier

  - JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp

  - JDK-8260029: aarch64: fix typo in verify_oop_array

  - JDK-8260308: Update LogCompilation junit to 4.13.1

  - JDK-8260338: Some fields in HaltNode is not cloned

  - JDK-8260349: Cannot programmatically retrieve Metaspace max set via JAVA_TOOL_OPTIONS

  - JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a

  - JDK-8260378: [TESTBUG] DcmdMBeanTestCheckJni.java reports false positive

  - JDK-8260497: Shenandoah: Improve SATB flushing

  - JDK-8260502: [s390] NativeMovRegMem::verify() fails because it's too strict

  - JDK-8260632: Build failures after JDK-8253353

  - JDK-8260704: ParallelGC: oldgen expansion needs release-store for _end

  - JDK-8261022: Fix incorrect result of Math.abs() with char type

  - JDK-8261089: [TESTBUG] native library of test TestCheckedReleaseCriticalArray.java fails to compile with gcc 4.x

  - JDK-8261183: Follow on to Make lists of normal filenames

  - JDK-8261209: isStandalone property: remove dependency on pretty-print

  - JDK-8261231: Windows IME was disabled after DnD operation

  - JDK-8261251: Shenandoah: Use object size for full GC humongous compaction

  - JDK-8261310: PPC64 Zero build fails with 'VMError::controlled_crash(int)::FunctionDescriptor functionDescriptor' has incomplete type and cannot be defined

  - JDK-8261334: NMT: tuning statistic shows incorrect hash distribution

  - JDK-8261413: Shenandoah: Disable class-unloading in I-U mode

  - JDK-8261522: [PPC64] AES intrinsics write beyond the destination array

  - JDK-8261534: Test sun/security/pkcs11/KeyAgreement/IllegalPackageAccess.java fails on platforms where no nsslib artifacts are defined

  - JDK-8261585: Restore HandleArea used in Deoptimization::uncommon_trap

  - JDK-8261753: Test java/lang/System/OsVersionTest.java still failing on BigSur patch versions after JDK-8253702

  - JDK-8261829: Exclude tools/jlink/JLinkReproducibleTest.java in 11u

  - JDK-8261912: Code IfNode::fold_compares_helper more defensively

  - JDK-8261920: [AIX] jshell command throws java.io.IOError on non English locales

  - JDK-8262018: Wrong format in SAP copyright header of OsVersionTest

  - JDK-8263069: Exclude some failing tests from security/infra/java/security/cert/CertPathValidator

Notes on individual issues:

===========================

core-libs/javax.naming:

JDK-8258824: LDAP Channel Binding Support for Java GSS/Kerberos

===============================================================

A new JNDI environment property "com.sun.jndi.ldap.tls.cbtype" has

been added to enable TLS Channel Binding data in LDAP authentication

over SSL/TLS protocol to the Windows AD server.  The only valid value

at present is "tls-server-end-point", where channel binding data is

created on the base of the TLS server certificate. See RFC-5929 [0]

and the module description of the `java.naming` module for further

details.

[0] RFC-5929 "Channel Bindings for TLS": https://www.ietf.org/rfc/rfc5929.txt

security-libs/java.security:

JDK-8260597: Added 2 HARICA Root CA Certificates

================================================

The following root certificates have been added to the cacerts truststore:

Alias Name: haricarootca2015

Distinguished Name: CN=Hellenic Academic and Research Institutions RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR

Alias Name: haricaeccrootca2015

Distinguished Name: CN=Hellenic Academic and Research Institutions ECC RootCA 2015, O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR

security-libs/javax.net.ssl:

JDK-8256490: Disable TLS 1.0 and 1.1

====================================

TLS 1.0 and 1.1 are versions of the TLS protocol that are no longer

considered secure and have been superseded by more secure and modern

versions (TLS 1.2 and 1.3).

These versions have now been disabled by default. If you encounter

issues, you can, at your own risk, re-enable the versions by removing

"TLSv1" and/or "TLSv1.1" from the `jdk.tls.disabledAlgorithms`

security property in the `java.security` configuration file.

tools:

JDK-8214213: jdeps --print-module-deps Reports Transitive Dependencies

======================================================================

`jdeps --print-module-deps`, `--list-deps`, and `--list-reduce-deps`

options have been enhanced as follows.

1. By default, they perform transitive module dependence analysis on

libraries on the class path and module path, both directly and

indirectly, as required by the given input JAR files or

classes. Previously, they only reported the modules required by the

given input JAR files or classes.  The `--no-recursive` option can be

used to request non-transitive dependence analysis.

2. By default, they flag any missing dependency, i.e. not found from

class path and module path, as an error.  The `--ignore-missing-deps`

option can be used to suppress missing dependence errors. Note that a

custom image is created with the list of modules output by jdeps when

using the `--ignore-missing-deps` option for a non-modular

application. Such an application, running on the custom image, might

fail at runtime when missing dependence errors are suppressed.

xml/jaxp:

JDK-8249867 XML declaration is not followed by a newline

========================================================

The DOM Load and Save `LSSerializer` does not have an explicit control