Running an app with @Configuration using Java 9 prints ugly illegal access warnings [SPR-15939]

[spring-projects-issues]

Dave Syer opened SPR-15939 and commented

When I run a basic Spring Boot app using Java 9 (and classpath, etc. - normal Java 8 command line), I see red WARN messages from the JDK. It seems they are caused by something in CGLib. Harmless but users will not like it.

$ java -cp target/demo-0.0.1-SNAPSHOT.jar:$CP com.example.demo.DemoApplication

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::  (v2.0.0.BUILD-SNAPSHOT)

2017-09-08 10:58:33.782  INFO 17229 --- [           main] com.example.demo.DemoApplication         : Starting DemoApplication v0.0.1-SNAPSHOT on tower with PID 17229 (/home/dsyer/dev/demo/workspace/demo/target/demo-0.0.1-SNAPSHOT.jar started by dsyer in /home/dsyer/dev/demo/workspace/demo)
2017-09-08 10:58:33.784  INFO 17229 --- [           main] com.example.demo.DemoApplication         : No active profile set, falling back to default profiles: default
2017-09-08 10:58:33.814  INFO 17229 --- [           main] ConfigServletWebServerApplicationContext : Refreshing org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext@1224144a: startup date [Fri Sep 08 10:58:33 BST 2017]; root of context hierarchy
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.springframework.cglib.core.ReflectUtils$1 (file:/home/dsyer/.m2/repository/org/springframework/spring-core/5.0.0.BUILD-SNAPSHOT/spring-core-5.0.0.BUILD-SNAPSHOT.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int,java.security.ProtectionDomain)
WARNING: Please consider reporting this to the maintainers of org.springframework.cglib.core.ReflectUtils$1
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
2017-09-08 10:58:34.803  INFO 17229 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 8080 (http)
...

Apparently, this is because --illegal-access=permit is the default in Java 9, so you can switch it off with --illegal-access=deny, but it's awkward to have a default setting that emits a warning.

If I run the app using modules, the error also goes away, which is interesting:

$ java -p target/demo-0.0.1-SNAPSHOT.jar:$CP --add-modules ALL-DEFAULT -m demo/com.example.demo.DemoApplication --endpoints.default.web.enabled=true

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/
 :: Spring Boot ::                        

2017-09-08 10:52:23.903  INFO 16567 --- [           main] com.example.demo.DemoApplication         : Starting DemoApplication on tower with PID 16567 (/home/dsyer/dev/demo/workspace/demo/target/demo-0.0.1-SNAPSHOT.jar started by dsyer in /home/dsyer/dev/demo/workspace/demo)
2017-09-08 10:52:23.905  INFO 16567 --- [           main] com.example.demo.DemoApplication         : No active profile set, falling back to default profiles: default
2017-09-08 10:52:23.930  INFO 16567 --- [           main] ConfigServletWebServerApplicationContext : Refreshing org.springframework.boot.web.servlet.context.AnnotationConfigServletWebServerApplicationContext@4f4c4b1a: startup date [Fri Sep 08 10:52:23 BST 2017]; root of context hierarchy
2017-09-08 10:52:24.716  INFO 16567 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 8080 (http)
2017-09-08 10:52:24.7
...

---

Affects: 5.0 RC3

Issue Links:

• MethodHandles.Lookup.defineClass for CGLIB class definition purposes [SPR-15859] #20414 MethodHandles.Lookup.defineClass for CGLIB class definition purposes ("duplicates")

[spring-projects-issues]

Juergen Hoeller commented

This effectively duplicates #20414. It's a known effect of CGLIB trying the ClassLoader.defineClass approach first, and since there is a fallback code path in CGLIB 3.2.5, it does indeed work once the illegal-access flag is switched to "deny". And in module path mode, it never appears for a start since "deny" is the enforced standard behavior there.