Skip to content

Do not pass unwritten splitter files to javac - #870

Open
mernst wants to merge 11 commits into
codespecs:masterfrom
mernst:splitter-unwritten-files
Open

mernst wants to merge 11 commits into
codespecs:masterfrom
mernst:splitter-unwritten-files

Conversation

@mernst

@mernst mernst commented Oct 6, 2026

Copy link
Copy Markdown
Member

javac compiles nothing if one of its arguments does not exist. So, when the source file for one splitter could not be written, SplitterFactory passed its name to javac anyway, and no splitter was compiled. Now SplitterFactory passes javac only the files that were written.

mernst and others added 2 commits October 5, 2026 20:53
javac compiles nothing if one of its arguments does not exist, so one
splitter whose source file could not be written prevented every splitter
from being compiled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@mernst mernst mentioned this pull request Oct 6, 2026
@coderabbitai

coderabbitai Bot commented Oct 6, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Warning

Review limit reached

  • Run on-demand review

This review includes 6 billable files and costs up to $1.50.

Or wait 21 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: codespecs/daikon/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: c77da527-13b4-402d-8ccf-dbcf870f97ed
📥 Commits

Reviewing files that changed from the base of the PR and between 0c03edd and 47dd64c.

📒 Files selected for processing (6)
  • java/daikon/split/FileCompiler.java
  • java/daikon/split/SplitterFactory.java
  • java/daikon/split/SplitterList.java
  • java/daikon/split/SplitterObject.java
  • java/daikon/test/AllTestsSuite.java
  • java/daikon/test/split/SplitterLoadTest.java

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: codespecs/daikon/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: f2114b5f-8b9c-43db-ae9b-e5ebcc0a2de8
📥 Commits

Reviewing files that changed from the base of the PR and between 779e30d and 0c03edd.

📒 Files selected for processing (6)
  • java/daikon/split/FileCompiler.java
  • java/daikon/split/SplitterFactory.java
  • java/daikon/split/SplitterList.java
  • java/daikon/split/SplitterObject.java
  • java/daikon/test/AllTestsSuite.java
  • java/daikon/test/split/SplitterLoadTest.java

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📝 Walkthrough

FileCompiler now captures compilation status and output streams, identifies javac error filenames, and retries eligible source files. SplitterFactory records parsing and file-operation errors on affected splitters, then compiles and loads only successfully written sources. SplitterObject now uses a shared compiled-class path method, and SplitterList adds a method to remove a program-point mapping. New tests cover loading valid splitters alongside splitters with parse, lexical, or source-write errors.

Priority: ⬇️ Low

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 0c03e

No actionable merge-blocking risk was established; the change is mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 0c03e

The change improves isolation of failed source generation and prevents failed preparation from loading an old class file. No new privilege escalation or confirmed attack path was established. Remaining uncertainty concerns cumulative compilation work and recovery when objects are reused or processing is interrupted.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The demonstrated execution scope is the configured compiler process, generated files, and the host JVM loading splitter classes. Tenant, service, credential, or environment-wide exposure cannot be determined from these source paths without deployment and input-trust context.

Trust Boundaries and Controls

  • observed — Diagnostic parsing cannot introduce a new retry filename: it populates an exclusion set, while process arguments are selected from original candidates. The executable remains controlled by existing compiler configuration. This rejects a new diagnostic-to-command injection path, without establishing that all caller-supplied configuration is trustworthy.

Resilience and Maintainability Implications

  • observed — Additional retries require a strictly smaller candidate list, preventing an unchanged-set retry loop. Each invocation retains a watchdog, and a detected timeout exits the JVM, as in the base. The new loop nevertheless permits more cumulative compilation work than the base's single retry; attacker-controlled workload exposure is not established.
  • inferred — Fresh objects are safely excluded after preparation failure. Reused objects require a separate recovery contract because setError does not clear an already loaded splitter or its existence flag. Normal registration consumes each processed array entry, so this conditional stale-state scenario is not retained as an established PR security concern; interruption and concurrent reuse remain unresolved.

Hardening Proposals

  • proposed — If splitter compilation is exposed to untrusted workloads, add an explicit batch-wide compilation budget. If object reuse or concurrent loading is supported, define per-attempt state reset and ownership rules rather than relying on one-shot consumption.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 24 functions across 6 files.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

mernst and others added 6 commits October 6, 2026 10:27
FileCompiler:
- Do not pass nonexistent files to the compiler; report them instead.
- Return errors from the recompilation as well as from the first compilation.
- Capture the compiler's standard output (it was read from stderr), and
  include it in the returned diagnostics.

SplitterFactory:
- Load only splitters whose source files were written, and record the real
  reason (parse or write failure) for the others.
- Delete a stale class file before writing a splitter's source.
- Delete a partially-written source file when writing fails.

Add SplitterLoadTest, which checks that an unparseable splitter does not
prevent another splitter for the same program point from loading.
- Treat a lexical error (TokenMgrError) in a splitter condition like a parse error.
- Include compiler standard output in the error output only when compilation fails.
- Normalize paths when matching javac error output against source files.
- Compute splitter source and class paths in one place, in SplitterObject.
- Remove the redundant nonexistent-file filter from FileCompiler.
- Test unwritable splitter files and lexical errors; clean up SplitterList after tests.
* Do not report duplicate compiler output from the javac recompilation, and
  skip a recompilation that would only repeat the first one.
* Find erroneous files only in javac's standard error, and permit spaces in
  their names.
* Report a failure to delete an old class file accurately, and register
  deleteOnExit before opening the splitter source file.
* Move SplitterLoadTest to package daikon.split so SplitterList.remove can be
  package-private; restore FileIO.new_decl_format; skip the tests when
  splitters cannot be compiled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Match only javac errors, not warnings, when finding erroneous files.
* Recompile repeatedly, because javac reports errors in phases.
* Move SplitterLoadTest to daikon/test/split.
* Derive the paths of the written splitter source files instead of maintaining a parallel list.
* Catch InvalidPathException when deleting splitter files.
Pull request codespecs#868 also adds SplitterList.remove.  With both definitions
at the same place, merging the two pull requests yields a conflict that
keeps one definition, rather than two methods with the same signature.
mernst added a commit to mernst/daikon that referenced this pull request Oct 7, 2026
codespecs#870 makes SplitterFactory compile and load only the splitters whose
source files were written, which a condition that cannot be translated
requires.  Use its implementation rather than a separate one; this pull
request now depends on codespecs#870.
@mernst

mernst commented Oct 11, 2026

Copy link
Copy Markdown
Member Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 11, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant