On Thu, 3 Sep 2026 19:16:30 GMT, Alan Bateman <[email protected]> wrote:
>> Hi @AlanBateman , >> Thanks for the comment — I’ve updated the patch to throw >> IllegalArgumentException instead of returning an empty loader. >> >> I did a quick search and couldn’t find real frameworks passing an array >> class to ServiceLoader; it seems like a fuzzing/differential-testing edge >> case. I agree IAE is better here since an empty loader could hide a real >> caller bug. > >> I did a quick search and couldn’t find real frameworks passing an array >> class to ServiceLoader; it seems like a fuzzing/differential-testing edge >> case. I agree IAE is better here since an empty loader could hide a real >> caller bug. > > Can you provide some context as to how you ran into the issue? Are you the > submitter of that bug? It's not clear if was encountered with something real > or a fuzzer. > > In any case, I attached > [IllegalServiceTypes1](https://bugs.openjdk.org/secure/attachment/121527/IllegalServiceTypes1.patch) > and > [IllegalServiceTypes2](https://bugs.openjdk.org/secure/attachment/121542/IllegalServiceTypes2.patch) > to the JBS issue with how SCE vs. IAE would look. IllegalServiceTypes2 is > more complete that the proposal in this PR because as it updates the > Designing service section, keeps the checks in the private constructor much > more complete test. Hi @AlanBateman. No, I’m not the submitter — I found the bug on JBS while looking for a small core-libs fix. I haven’t seen this in real code; the issue reads like a differential-testing/fuzzer finding, not a production failure. I’ll update the PR to align with IllegalServiceTypes2. ------------- PR Comment: https://git.openjdk.org/jdk/pull/32515#issuecomment-5542866031
