Oracle GraalVM for JDK 21.0.9

(2025-10-21)

This is the October 2025 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the October 2025 Oracle Critical Patch Update Advisory. It includes the security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to 21.0.9+7. See Java SE 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.9 are designed for use with GraalVM for JDK 21.0.9.
• Graal compiler
  • Improved partial escape analysis to handle excessive fixpoint iterations more efficiently.
• Native Image
  • Improved partial escape analysis to handle excessive fixpoint iterations more efficiently.
  • Fixed libgraal-specific collection policy to return the correct name.
  • Improved error handling to properly rethrow OutOfMemoryErrors during performance data initialization.
  • Enhanced Native Image agent to properly handle getSystemResource method calls.
  • Enhanced UserException reporting to print all causes for better debugging.
  • Fixed SubstrateDiagnostics and OutOfMemoryError handling.
  • Improved -XX:FlightRecorderLogging error message for unknown tag sets
  • Fixed JFR garbage collection event reporting.
  • Added substitutions for unsupported Foreign Function & Memory (FFM) API calls.
  • Implemented cross-isolate exception dispatch for isolated compilation scenarios.
  • Provided LLVM version information to resolve stdio.h missing header issue.
  • Added SBOM PURL (Package URL) support for better software bill of materials tracking.
  • Fixed hang issue in Espresso standalone when G1 Garbage Collector encounters unrecognized arguments.
  • Enhanced heap verification with more detailed diagnostics when broken stack references are detected.
  • Removed AMD64.CPUFeature.HT from build time CPU features.
• Truffle framework
  • Made EventBinding a context heap boundary.
  • Implemented cross-isolate exception dispatch for isolated compilation scenarios.
  • Fixed NullPointerException in dead thread disposal.
  • Fixed inefficient caching behavior in HostExecuteNode.doVarArgs() that could impact performance.
• GraalJS
  • Fixed UnsupportedSpecializationException caused when PropertyGetNode receives null values.
  • Fixed BitSets.equals() implementation.
• TRegex
  • Updated pre-defined character classes in OracleDBFlavor for better compatibility.
  • Improved handling of nested quantifiers in OracleDBFlavor by treating them as bailouts instead of syntax errors.
  • Fixed BitSets.equals() implementation.
• Espresso
  • Fixed hang issue in Espresso standalone when G1 Garbage Collector encounters unrecognized arguments.

Oracle GraalVM for JDK 21.0.8

(2025-07-15)

This is the July 2025 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the July 2025 Oracle Critical Patch Update Advisory. It includes the security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to 21.0.8+12. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.8 are designed for use with GraalVM for JDK 21.0.8.
• Graal compiler
  • Fixed handling of ObjectClone in EnterpriseReadElimination.
  • Added stricter checks for CFG and schedule validity.
  • Fixed short jump across unknown alignment in AMD64ArrayIndexOfOp.
  • Prevented vectorization of reads with usages both inside and outside the loop.
  • Emitted additional reinterpret when generating float CAS from node matching rules.
  • Ensured CompilationAlarm does not interfere with snippet creation.
  • Used DWORD comparisons for search values in AMD64ArrayIndexOfOp.
  • Created a proper guard in LoopInversion to cover the entire iteration range, not just the first iteration.
  • Added proper handling of nested frame states in loop vectorization.
• Native Image
  • Fixed ThreadLookup.matchesThread().
  • Fixed and added more information to the crash log output.
  • Prevented Java records from using Word types.
  • Marked certain constant loads as not rematerializable to the stack.
  • Applied various Graal compiler fixes and added the option -XX:+PrintVMInfoAndExit to the Serial GC.
  • Enabled processing of each class’s classloader in JfrTypeRepository.
  • Applied various fixes for system properties and locales, including:
    • Fix for SystemPropertiesSupport
    • Fix for locale initialization crashes
    • Allowing StaticProperty.<clinit> to execute before system properties are fully initialized
  • Verified that DynamicHubs are addressable.
  • Fixed memory barrier if Object.clone() is missing.
  • Fixed handling of ObjectClone in EnterpriseReadElimination.
  • Corrected class names in heap dumps.
  • Fixed issues with G1 image heap layouts.
  • Fixed short jump across unknown alignment in AMD64ArrayIndexOfOp.
  • Prevented absent hashcode computation from being split across safepoint checks.
  • Fixed java.specification.maintenance.version.
  • Enforced recurring callbacks to be allocation free.
  • Fixed JFR-related UnsatisfiedLinkErrors.
  • Prevented new substitutions for bundle apply without create.
• Truffle framework
  • Reduced the number of threads for sandbox limit checking and ensured they are stopped when no active contexts remain.
  • Allowed the compiler to be newer than the Truffle runtime in a minor version.
  • Improved System.out/err usage in PolyglotLoggers.
  • Fixed out-of-bounds read in AMD64CodepointIndexToByteIndexOp.
  • Fixed return type compatibility check that could lead to void specializations being filtered.
  • Upgraded JLine to version 3.28.
• GraalJS
  • Fixed ClassCastException in super property access.
  • Modified ExportValueNode.doTruffleObject() to exclude SafeIntegers.
  • Ensured Map.prototype.forEach imports key and value of foreign hash entries.
  • Corrected Array.prototype.flat() to avoid producing a foreign array.
  • Upgraded double-conversion to version 3.3.0.
  • Ensured dates with missing UTC offset are interpreted as UTC time in nashorn-compat mode when strict.
• GraalWasm
  • Added missing Truffle Safepoint poll in the bytecode interpreter loop.
• TRegex
  • Fixed the GenerateDFAImmediately option to free the NFA matcher.

Oracle GraalVM for JDK 21.0.7

(2025-04-15)

This is the April 2025 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the April 2025 Oracle Critical Patch Update Advisory. It includes the security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to 21.0.7+8. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.7 are designed for use with GraalVM for JDK 21.0.7.
• Compiler
  • Add the new test case: do not remove loop safepoints from int loops, use strip mining.
  • Added vzeroupper upon the entrance of AMD64 sha1 and sha256 stubs.
  • Moved resetting of rethrowExceptions to creating jump targets.
• Native Image
  • Virtual threads report disabled preview features when they are disabled for another reason.
  • Fixed System.getProperties() when called from virtual thread.
  • Fixed @Uninterruptible.
  • Fixed a transient in CodeInfoGCTests.lifecycle() and added other various fixes for the testing infrastructure.
  • Implemented the use of the correct acquisition count in acquireOnOOME.
  • Improved causal reporting for unresolved elements.
  • Fixed BuildPhaseProvider methods and VM diagnostics registration.
  • Fixed a transient failure in TestThreadCPULoadEvent.
  • Added multiple fixes for look-behind merging across main expression boundary.
  • Fixed the conditional configuration algorithm to avoid losing configuration data.
  • Implemented to fall back to a non-containerized bundle build when generating with --static.
  • Marked the type of a hidden field as reachable during reflection metadata processing.
  • Fixed ServiceLoader based on module-info.java not working when generating a native image.
• GraalWasm
  • Fixed br_table branch profiles.
• GraalJS
  • Upgraded the underlying Node.js to version 18.20.6.
  • Fixed a compilation failure in ImportMetaNode.
  • Fixed TruffleStringBuilder and RepeatNode breaking string compaction invariants.
  • Upgraded the ASM dependency to 9.7.1.
• TRegex
  • NFA generator overhaul.
  • Added multiple fixes for look-behind merging across main expression boundary.
  • Fixed TruffleStringBuilder and RepeatNode breaking string compaction invariants.
• Truffle framework
  • Added the MaximumCompilations option.
  • Fixed tier_count values in the CPU sampler JSON output.
  • Fixed TruffleStringBuilder and RepeatNode breaking string compaction invariants.
  • Upgraded the ASM dependency to 9.7.1.

Oracle GraalVM for JDK 21.0.6

(2025-01-21)

This is the January 2025 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the January 2025 Oracle Critical Patch Update Advisory. It includes the security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to 21.0.6+8. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.6 are designed for use with GraalVM for JDK 21.0.6.

This release also includes the following fixes:

• Graal compiler
  • Fix Vector API CompareNode propagating the wrong unorderIsTrue value.
  • Deactivate CheckGraalInvariants.checkOptionFieldUsages when JaCoCo is active.
  • Add safepoint policy changes.
  • Pi node: guard against deletion in recursion.
  • Do not permit FixedGuardNode and ConditionAnchorNode to go away if there are PiNodes attached.
  • Infinite recursion in AArch64MacroAssembler.add/sub with immediate = Integer.MIN_VALUE.
  • Add an explicit null check on StringBuilder(String) constructor’s argument.
  • Add Bytecode DSL compiler intrinsics.
  • Allow no exit safepoint if end safepoints are disabled.
• Native Image
  • Process --version, --help, and --help-extra similar to java.
  • Update the VisualVM documentation and add more validation for the option --enable-monitoring.
  • Adopt JDK-8314794: Improve UTF8 String support.
  • Set ImageBuildID for analysis tests.
  • Implement better messages for OutOfMemoryErrors.
  • Allow that svmtests add further data to the CAP cache.
  • Test inclusion of system modules required by the application but not the builder
  • Fix JFR-specific substitutions on JDK 21.
  • Eagerly initialize caches in method handle implementation.
  • Add the option to disable substitutions.
  • Preserve local symbols if the post-link stripping follows.
  • Align image heap end when using mremap.
  • Ensure full watchdog interval is available per method in LIRNativeImageCodeCache.patchMethods.
• Truffle framework
  • Remove dead threads from PolyglotContextImpl#threads during a new thread initialization.
  • Handle static frame slots in BytecodeOSRMetadata#restoreParentFrame.
  • Do not permit FixedGuardNode and ConditionAnchorNode to go away if there are PiNodes attached.
  • Clear polyglot source cache more aggressively.
  • Fix the documentation for the sandbox.MaxHeapMemory resource limit.
  • Add bytecode DSL compiler intrinsics.
  • Remove the workaround for array-based static object crash.
  • Forcing fallback runtime fails on release builds with enterprise.
  • Fix int overflow in ObjectSizeCalculator#increaseByArraySize.
• GraalJS
  • Correction of the handling of long and foreign values.
  • Fix DynamicObjectLibrary.setPropertyFlags.
  • Fix of top-level for-await-of in a module.
  • Do not permit FixedGuardNode and ConditionAnchorNode to go away if there are PiNodes attached.
  • Ensure missing number exponent results in the early SyntaxError.
  • Add js.locale to polyglot-signature.txt.
  • Make the js.load option stable and allowed in sandboxed mode.
  • Fix missing return value conversion in Polyglot.eval[File].
  • Handle mixing overloaded operators with non-numeric primitives.
  • GraalJSScriptEngine: Fix NPE when setting empty engine bindings (#840).
  • Make the option js.webassembly stable now.
  • Update JavaScript stable options. GraalWasm
  • Remove constant memory buffer assumption.
• Handle static frame slots in BytecodeOSRMetadata#restoreParentFrame. Espresso
  • Remove the workaround for array-based static object crash. TRegex
  • Fix OracleDB flavor incorrectly parsing escaped surrogate pairs.

Oracle GraalVM for JDK 21.0.5

(2024-10-15)

This is the October 2024 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the October 2024 Oracle Critical Patch Update Advisory. It includes the security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to 21.0.5+9. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.5 are designed for use with GraalVM for JDK 21.0.5.
• Graal compiler:
  • Implemented a loop exit: all with exception nodes that are used as value nodes need begin nodes for schedule.
  • Fixed StringBuilderOverflowTest#testInSubprocess failing.
  • Skip StringBuilderOverflowTest when -XX:-CompactStrings is enabled.
  • Improved detection of unused @Fold methods.
• Native Image:
  • Added support for registering custom UnmanagedMemorySupport implementations.
  • Added support for Intel oneAPI DPC++/C++ Compiler (ICX) compiler in toolchain detection of Native Image.
  • Updated the ProfileInferenceFeature.checkOsVersion() function to ignore white spaces in OS name.
  • Fixed a crash in InheritedChannel.inetPeerAddress0().
  • Prevent large array allocations in VM-internal code trigger OutOfMemoryErrors.
  • Added tests to check if the runtime boot module layer contains the Main module.
  • Added integration tests to ensure compatibility if non-existing packages are opened/exported.
  • Fixed deoptimization into an exception handler.
  • Reduced logging overhead in debug info generator.
  • Fixed StrengthenGraphs for LoadFieldNode when analysis is context sensitive.
  • Added various JNI-related bugfixes.
  • Added check to ensure NoClassDefFoundError during a reflective call.
  • Updated JavaMonitor to jdk-24+11.
  • Improved Serial GC heap verification and added other GC-related changes.
  • Reset the Provider.Service.constructorCache field.
  • Made caches in ValueConversions initialize eagerly.
  • Backport reachability-metadata.json handling to JDK 21.
• Espresso:
  • Disabled Eclipse compiler for Java (ECJ) tests that are not compiled with the ecj compiler anyway.
• JavaScript:
  • Error message(s) appearing across context(s) boundaries.
  • I/O permissions are required even though the module is already evaluated.
  • Fixed a JavaScript interpreter causing TRegex to fail with IndexOutOfBoundsException.
  • Upgraded the underlying Node.js to version 18.20.4.
• GraalWasm:
  • Fixed WebAssembly caching.
• TRegex:
  • Fixed missing recursive backref guard on group escapes for OracleDBFlavor.
  • Fixed a JavaScript interpreter causing TRegex to fail with IndexOutOfBoundsException.

Oracle GraalVM for JDK 21.0.4

(2024-07-16)

This is the July 2024 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the July 2024 Oracle Critical Patch Update Advisory. It includes security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to 21.0.4+8. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.4 are designed for use with GraalVM for JDK 21.0.4.
• Graal compiler:
  • Fixed simplification of always-deopt FixedGuard.
  • Added a fix to use correct compare size in AMD64NormalizedUnsignedCompareOp.
  • Fixed SIMD reinterpret stamp folding.
  • Added epsilon to more floating-point probability comparisons.
  • Fixed AArch64AtomicMove.
  • Fixed a crash in VectorConsumerPhase.
  • Improved Strip mining optimization to not strip mine loops with CaptureStateBegin successors.
  • Fixed a crash in VectorConsumerPhase.
  • Improved Counted strip mining optimization to use correct inner-to-outer state.
  • Unsigned loops that need an overflow to terminate must not be counted.
  • Properly implemented isConstantStride for masked negate strides.
  • Added tests for EVEX encoding of various instructions.
• Native Image:
  • Updated the -g option to include all information for profiling. Fixed the issue with the objcopy strip command.
  • Added a test case where we run out of memory while entering a synchronized block.
  • Made reference processing more robust, especially against OOME during tear-down.
  • Added a few OutOfMemoryError-related fixes.
  • Removed OpaqueValueNodes at the end of low tier.
  • Changed CCharPointer from “signed char” to “char”.
  • Fixed NPE in isRegisteredDeoptEntry.
  • Implemented skipping a G1 argument parsing if -H:-ParseRuntimeOptions is specified.
  • Optionally ignore OutOfMemoryErrors while in VM-internal code.
  • Removed getpwuid in favor of getpwuid_r.
  • Added a check to exclude certain GC tests when the Epsilon GC is used. Improved testing infrastructure.
  • Fixed values reported in the GCHeapSummary JFR event.
  • Fixed data limitation for breakdown charts in build reports.
  • Made stack pointer aligned while in deoptStub.
  • Fixed a consistency issue in HeapImplMemoryMXBean.getHeapMemoryUsage().
  • Added the runtime module layer tests.
  • Made recomputing Buffer.address field for array-based buffers in the image heap.
  • Fixed NullPointerException in PrintMethodHistogram.
  • Added partial support for physical memory usage and JFR tests for periodic native events.
  • Made using an instance field instead of a static field.
  • Made using a non-cryptographic hash for IsolatedSpeculationReasonEncoding.
  • Records cannot use Word types.
  • Added a check to report an error if building a static native executable without musl libc.
  • Do not treat yellow-zone code as VM-internal code.
• Truffle framework:
  • Fixed FileSystemsTest#testSetAttribute() failing on Linux.
  • Improved the error message when a polyglot implementation is missing.
  • Disabled LoggingTest#testDisableLoggersSingleContext.
  • Fixed the issue when com.oracle.truffle.polyglot.InternalResourceRoots$Root.path() could not be invoked because this.owningRoot was null.
  • Fixed the issue when SpeculationReason could not be re-used after the speculate call.
  • Made using a concrete VirtualFrame return type to help static analysis.
• Java on Truffle (Espresso):
  • Fixed the JDWP method invocation.
  • Fixed NPE in JDWP when a debugger asks for local variable table.
  • Fixed single stepping in Espresso JDWP when stepping within not yet loaded code.
  • Fixed stepping into intrinsified Java methods in JDWP.
• JavaScript:
  • Upgraded the underlying Node.js to version 18.20.2.
  • Disabled introspection data for JS nodes.
  • Fixed a potential ArrayIndexOutOfBoundsException when setting an element at a negative index.
  • Instanceof operator should check whether the left side is a (foreign) object.
  • Increased default typed array size limit to 2GB.
• Tooling:
  • Updated CPUSampler to not log interrupts if the sampler is already closed, and added various other CPUSampler fixes.
• TRegex:
  • Added support for match-begin and match-end position assertions for compatibility with the OracleDB flavor.

Oracle GraalVM for JDK 21.0.3

(2024-04-16)

This is the April 2024 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the April 2024 Oracle Critical Patch Update Advisory. It includes security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to 21.0.3+7. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.3 are designed for use with GraalVM for JDK 21.0.3.
• Graal compiler:
  • Fixed magic number calculation for Integer.divideUnsigned.
  • Return null when inverting a SIMDStamp if one component cannot be inverted.
  • Mark all killed XMM registers as @Temp in AMD64SHA256AVX2Op.
  • Return null when inverting a SIMDStamp if one component cannot be inverted.
  • Increased supported jump distance to tail call trampolines on AArch to 128MB.
  • Added a fix to Initialization Vector (IV): only non-overflowing constant properties should be constant.
  • Counted strip mining optimization fixes:
    • Improved long to int overflow logic
    • Ensure that loop exit states are unique
  • Add a test for incorrect optimization of compares on narrows.
  • Added a check to ensure CompilationResult.methods does not contain duplicates.
  • Fixed read nodes must only be removed if they are not used as null checks.
  • Fixed FrameStates for unresolved deoptimizations with incorrect stack size.
  • Ensure guards are attached to MoveGuardsUpwards to respect a DOM tree.
  • Removed SIMD vectorization.
  • SVM Hooks for the MPK implementation for memory isolation in Oracle Database Multilingual Engine.
• Native Image:
  • Only use -H:Path validation in non-bundle mode.
  • Fixed the debug section alignment which can lead to corrupt debug information.
  • Changed a lifecycle of JIT-compiled code.
  • Added improvements to crash log.
  • Added constant fold reflection lookups in sun.nio.ch.Reflect.
  • Calling getStackTrace on recently started platform thread can crash.
  • Introduced the option to ignore profile version check.
  • Use a custom exception handler for @SVMTests.
  • Create additional artifacts only on successful build.
  • Fixed Cpuid1Ecx feature parsing for AMD CPUs.
  • Preprocess _MSC_FULL_VER to detect cl.exe version information.
  • Fixed a bug in IsolateArgumentParser.
  • Introduced the new option -H:+PGOPrintUnmatchedPercentage.
  • Always apply JVMTI-related substitutions.
  • Correctly handle printing certain JSON values in Native Image agent trace files.
  • Avoid deadlocks when the VM is out-of-memory and other threading-related fixes.
  • Introduced ReportFatalErrorOnOutOfMemoryError.
  • Introduced dump and reset methods for PGO profiling.
  • Use unsigned monitor and identity hash offsets and guarantee (not assert) that they are valid.
  • Removed Heap.allowPageSizeMismatch() and provided a method to set the physical memory size.
  • Prevent macronodes in deoptimization targets.
  • Added container support related fixes for G1 and support that run-time page size is smaller than build-time page size.
  • Handle recently started threads without a Thread object and NPE during VMOperation.
  • Invocation profiles are not needed for JIT compilation.
  • Make Lambda class names format consistent with the JDK name format.
  • Reduced the number of spawned threads to prevent timeouts.
  • Fixed issues with conditional profiles.
  • Consolidate application module name detection.
  • Properly catch exceptions during shutdown.
  • Fixed a deadlock in IsolateAwareTruffleCompiler.tearDownIsolateOnShutdown.
  • Added workaround for a build-time crash.
  • Added CompilationIsolateOptions.
  • Make the segfault handler more robust.
  • Fixed a failure when no resource bundle nullary constructor is present.
  • Improved intrinsification of method handles.
  • Improved the uncaught exception handler and error handling in CEntryPointSnippets.initializeIsolate().
  • Execute the LogManager shutdown hook after all other shutdown hooks.
  • Consider stack slot sizes when limiting number of parameters in SBOutlining.
  • Switched aarch64registerconfig to check for Darwin instead of not Darwin.
  • Make options engine.CompilerThreads and engine.CompilationFailureAction available under UNTRUSTED sandbox policy.
  • Fixed failing JFR tests.
  • Avoid unnecessary NodeSourcePosition for runtime compilation.
• Truffle framework:
  • Added a fix to prevent fails even if class loader is disabled.
  • Added a fix to prevent leaking of WeakReference objects in the Truffle sandbox mode.
  • Assertion error when internal resource cache is overriden by the polyglot.engine.resourcePath system property.
  • Incompatible NFI library change to the latest LTS release.
  • Introduced PolyglotInstrument#readyForContextEvents to fix a context listener race.
  • Do not inline ThrowableTracer#traceError.
  • Added InsertGuardFencesPhase into runtime compilation phases.
  • NullPointerException while diagnosing compilation failure when using compilation in isolate.
• Javascript:
  • Do not rethrow internal parser errors as SyntaxError.
  • Deoptimize loops in NetSuite Javascript code.
  • Fixed a possible infinite recursion in AbstractJSObjectArray.setElementImpl.
  • Upgraded the underlying Node.js to version 18.19.1.
  • Fixed wasm.jar not being included in Node.js JVM standalone.
• Java on Truffle (Espresso):
  • Fixed the annotation processor for Espresso interop nodes.
• GraalVM integration:
  • Exclusion of library configs of the main component from JVM standalones.

Oracle GraalVM for JDK 21.0.2

(2024-01-16)

This is the January 2024 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the January 2024 Oracle Critical Patch Update Advisory. It includes the security fixes released as part of that CPU, some noteworthy bug fixes, listed below, and platform updates.

• Updated the Oracle JDK release on which Oracle GraalVM is built to:
  • 21.0.2+13 for Java 21-based Oracle GraalVM. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.2 are designed for use with GraalVM for JDK 21.0.2.
• Compiler fixes:
  • Rearranged binary arithmetic operations that may be re-associated for loop invariants and constants.
  • Fixed Sulong benchmarks failing because of compilation failures.
  • Improved the conditional move optimization cost calculation.
  • Fixed a bug causing a StackOverflowError in ConditionalMoveOptimizationPhase when compiling ahead of time the Bouncy Castle library in a Java host application with Python code.
  • Improved the AArch64 architecture support: allowed BranchOp to emit FarBranch; made AArch64 HotSpot null constant code generation more generic.
  • Ensured Guards Anchor to CaptureStateBegin.
  • The compiler now checks stamps before casting in IntegerLessThanNode.
  • HeapImpl.dirtyAllReferencesOf must be no-op for the Epsilon garbage collector.
  • Simplified the ValueAnchorNode implementation.
  • Removed explicit null check exceptions during generation of checkcast and instanceof.
• Native Image fixes:
  • Updated OS detection code to recognize Windows 11 and Windows Server 2022.
  • Added an option that allows VM operations to exceed the max heap size.
  • Fixed a problem with -XX:+PrintGCSummary if assertions are enabled.
  • Fixed crashes during isolate teardown.
  • Native Image now ignores crashed threads.
  • Improved the OutOfMemoryError messages.
  • Fixed a check in EnterpriseAddressRangeCommittedMemoryProvider.
  • Native Image now reports consistent values when memory usage is queried via MemoryPoolMXBean.
  • Introduced the --disable-debuginfo-stripping argument for the mx tool.
  • Fixed handling native-image JSON properties stored in the wrong location.
  • Added a fix to prevent System.console().readPassword failures.
  • Improved mangling of primitive types in BFD name mangler#7423.
  • Fixed the native-image --bundle-create,container command failing if a driver is an image.
  • Made the initialization cycle break in NIO/cgroups code.
  • Treat stack as an executable if G1 garbage collector is built as a shared library.
  • Fixed a transient guarantee failure in PointsToAnalysisMethod.getContextInsensitiveVirtualInvoke.
  • Improved the JFR support: switched to PlatformThreads.getCurrentThreadOrNull() instead of Thread.currentThread(); fixed race condition in JVM.commit(long).
  • Ensured DeoptTargets are generated for methods requiring FrameInformation.
  • Now the Native Image builder uses synchronized data structures for reachability handlers registration.
  • Added an async-signal-safe way to dump crash logs.
  • Added an option to artificially increase the header size.
  • Fixed stack walking heuristic used for the Native Image crash log.
  • Fixed joinThreadUnmanaged on Windows.
  • Used the vendor version for __svm_version_info.
  • Made the builder use ThreadLocal for AccessControlContext stack.
  • Fixed class-path order when MANIFEST files include “Class-Path” attributes.
  • Added support for execution of bootstrap methods at image run time, and support “constant dynamic” execution at image run time.
  • Fixed the G1 garbage collector thread claiming logic.
  • Native Image now prints crash log when exception handling fails.
  • Fixed clinit simulation for arraycopy with null values.
  • Included signers in the native executable only if registered.
  • Do not use the shadow heap for fields annotated with @Unknown*Field.
• Truffle framework fixes:
  • Mixing a GraalVM without obfuscation with obfuscated Maven artefacts fails.
  • Handle json-23.1.0.jar native-image.properties stored in the wrong location.
  • Upgraded the JSON parser library, org.json, to version 20231013.
  • Fixed regression in spawning an Espresso context on platforms where it runs on Sulong.
  • Fixed handling unlinked types in runtime compilation.
  • Disabled the class-path isolation by default.
  • Added polyglot version checks for unchained.
  • Added assertion triggers check that fails and throws an exception.
  • Changed global PolyglotIsolate.Lazy#hostToGuestObjectReferences to per HSContext.
• Tools:
  • Added the mandatory experimental property debuggerId and handle GET of the /json/list path.
• Javascript:
  • Updated the expected Node.js structure after the update to version 18.18.2.
  • Prevent automatic leave of an explicitly entered context during close called from a host call.
• LLVM:
  • Initializing LLVM fails if built with Xcode 15.
  • Regression in the Sulong library loading when IO access is denied.
• Java on Truffle (Espresso):
  • Removed the need for a foreign field in EspressoForeignList.
  • Added missing Espresso artifacts on Maven.
  • Fixed ToEspresso collection type nodes not handling Espresso objects.
  • Fixed type converter combination for foreign exceptions and custom type converters.
• Python:
  • Fixed Python JVM standalones only working on GraalVM Community Edition.
• Ruby:
  • Run all TruffleRuby tests on standalones.
• WebAssembly:
  • File system access from GraalWasm.
• TRegex:
  • Added OracleDB flavor.
• GraalVM integration:
  • Updated Jipher JCE to 10.32 and pki to 10.15.
  • Fixed a list of deployed artifacts.
  • Lambda without a target invoke.

Oracle GraalVM for JDK 21.0.1

(2023-10-17)

This is the October 2023 Oracle Critical Patch Update (CPU) for Oracle GraalVM for JDK 21. This release contains fixes to security vulnerabilities announced in the October 2023 Oracle Critical Patch Update Advisory. It includes the security fixes released as part of that CPU, some noteworthy bug fixes (listed below) and platform updates.

• Updated Oracle GraalVM for JDK 21 to 21.0.1+12. See JDK 21 Release Notes.
• Version compatibility:
  • Truffle languages and other components version 23.1.1 are designed for use with GraalVM for JDK 21.0.1.
• Compiler fixes:
  • Changed constant blinding to use RuntimeRandomness for ahead-of-time compilation.
  • Added FarBranch support for BranchOp for the AArch64 architecture.
• Native Image fixes:
  • Fixed process crashing when uncommitting unused memory.
  • Added CEntryPointError if the stack boundaries cannot be determined.
  • Removed no longer needed JDK-specific Java Flight Recorder code.
  • Fixed an occasional crash using ProcessBuilder on macOS.

Oracle GraalVM for JDK 21

(2023-09-19)

• Platform and Distributions
• Removed Functionality
• Deprecated Functionality
• Availability of New JDK 21 Features
• Java and Compiler
• Native Image
• Splitting GraalVM SDK
• Polyglot Embedding
• JavaScript and Node.js
• Java on Truffle
• LLVM
• Truffle Language and Tool Implementations

Platform and Distributions

• Released Oracle GraalVM for JDK 21 based on Oracle JDK 21. See JDK 21 Release Notes.
• Released language runtimes as standalone distributions, therefore there are no language launchers in the GraalVM JDK. Two standalone language runtime options are available for both Oracle GraalVM and GraalVM Community Edition: a Native Image compiled native launcher or a JVM-based runtime (included). To distinguish between GraalVM editions, the GraalVM Community Edition version has the suffix -community in the name, for example: graaljs-community-<version>-<os>-<arch>.tar.gz. To distinguish between the runtime mode, a JVM standalone type has the -jvm part in a name. Standalone distributions are available on GitHub, in corresponding language repositories. Learn more here.

Removed Functionality

• Removed GraalVM Updater, gu, used to extend GraalVM installations with GraalVM language runtimes and other components by modifying the installation directory. As part of the alignment with OpenJDK, modifying JDK installations is not common. To continue using the GraalVM language runtime(s) and other components, use language standalones or specify them as Maven or Gradle dependencies in your project. For more information, see Polyglot Embedding updates and the GitHub issue #6855.
• Removed the option --language:<language> (to enable a specific language runtime at build time) and some macro options. See below for more details.

Deprecated Functionality

• The LLVM Toolchain component is deprecated for removal in Oracle GraalVM for JDK 23.

Java and Compiler

• Implemented initial optimization of Java Vector API (JEP 338) operations. Load, store, basic arithmetic, reduce, compare, and blend operations are transformed to efficient machine instructions where possible. It is enabled by default and can be disabled with -Dgraal.OptimizeVectorAPI=false. This optimization is not yet available in GraalVM Native Image. Coverage of more operations and Native Image support are planned for the future. This optimization is experimental.
• Implemented all intrinsics prior to JDK 21 on both AMD64 and AArch64 architectures for the Graal compiler. We have also ported various HotSpot assembly stubs into Java, including all of the SHA message digest stubs and part of the BigInteger arithmetic computation stubs. This allows Native Image to benefit from these high performance assembly codes.
• Users can enable backward-edge CFI in the Graal compiler by setting the -XX:UseBranchProtectionHotSpot option. Whether the user provides standard or PAC-RET protection, the Graal compiler will automatically enable backward-edge CFI when running on the AArch64 architecture. Before a function returns, the Graal compiler issues an authentication instruction that checks the integrity of the signed return address. If this integrity check fails, the authentication instruction stamps the higher bits of the corrupted address reserved for the pointer authentication code (PAC) to invalidate the pointer. When the function returns to the corrupted pointer, then the OS will raise a SIGSEGV signal, since the corrupted pointer now refers to an invalid (for example, unmapped) address. Even if an adversary has full control over the stored return address, the authentication instruction takes away control by resetting whatever the adversary provides to a random point high up in the process address space. Learn more about UseBranchProtection here.
• The following JDK 21 features are not available:
  • JEP 439 Generational ZGC

Native Image

New Features

• Users can now use G1 Garbage Collector on the Linux AArch64 architecture to build efficient native executables with large heaps and minimal pause times (not available in GraalVM Community Edition). Previously, it was only available for Linux AMD64. To enable it, pass the option --gc=G1 to the native-image builder. Learn more about Memory Management in Native Image.
• Introduced a new class initialization approach that will become the default in the future: all classes are now allowed to be used and initialized at build time, regardless of the class initialization configuration. For classes that are configured as “initialize at run time” this means that they will appear as uninitialized again at run time. To enable the new approach, pass the --strict-image-heap flag to Native Image. For more information and implementation details, take a look at the proposal #4684. Note that there is a known issue when a build that does not satisfy the new policy would fail with the following error: Boolean option value can be only + or -. This will be resolved in a patch release on October 17, 2023 and we will share more details on the new policy and best practices in the upcoming blog post.
• Improved the reporting of missing metadata by throwing MissingReflectionRegistrationError when attempting to create a Proxy class without having it registered at build time, instead of VMError.
• Added optimization level 3 to the native-image builder for the best peak performance (not available in GraalVM Community Edition). This new level includes optimizations that previously were part of optimization level 2 and that work best together with Profile-Guided Optimizations. As a result, the compilation time when building with the default -O2 is significantly reduced. Also, the --pgo option automatically enables -O3.
• Added experimental support for foreign down calls (OpenJDK project Panama) in Native Image. Please test it and provide feedback. Support for upcalls is planned for the future.

• Added the option --parallelism to control how many threads are used by the Native Image build process. The minimal number is 2. This option is useful for build environments with constrained resources. Also, starting from this release, the build output will print out the memory and thread limits of the build process, for example:

    Build resources:
    - 13.24GB of memory (42.7% of 31.00GB system memory, determined at start)
    - 16 thread(s) (100.0% of 16 available processor(s), determined at start)
  

• Added the option --color[=WHEN] to color the build output. Replace WHEN with always, never, or auto. This API option supersedes the experimental option -H:+BuildOutputColorful.
• Introduced a new option -H:±UnlockExperimentalVMOptions to explicitly unlock access to experimental options, the majority of hosted options (starting with -H:), in Native Image. If access is not explicitly requested, an attempt to use any experimental option will fail the build with an actionable error message in this release. Also, to help users understand which dependencies requested these options, active experimental options will be listed as part of the build output alongside their origin. In the next release, this warning will be turned into a build failure. Meanwhile, the community is encouraged to open issues if certain experimental options should be promoted to public API and marked as stable. For more information, see GitHub issue #7105.
• The following JDK 21 features are not available:
  • JEP 439 Generational ZGC
  • JEP 442 Foreign Function & Memory API (Third Preview)
  • JEP 448 Vector API (Sixth Incubator)

Debugging and Monitoring Improvements

• Improved the monitoring experience: added support for the Java Flight Recording ThreadCPULoad event. (Together with BellSoft.)
• Added support for -XX:+HeapDumpOnOutOfMemoryError. (Together with Red Hat.)

See a complete list of updates in the changelog.

Refactoring GraalVM SDK

The GraalVM SDK is split into four fine-grained modules. The use of the graalvm-sdk module is now deprecated. Note that all GraalVM APIs remain compatible in this release. The following new modules are available:

• org.graalvm.nativeimage: The public API of Native Image for advanced use cases.
• org.graalvm.polyglot: A library that allows to embed polyglot language implementations in Java.
• org.graalvm.word: A low-level library for machine-word-sized values in Java.
• org.graalvm.collections: A collections library for GraalVM components.

Update your Maven and module dependencies accordingly. If you previously used the GraalVM SDK for Native Image via:

<dependency>
    <groupId>org.graalvm.sdk</groupId>
    <artifactId>graal-sdk</artifactId>
    <version>23.1.0</version>
</dependency>

Now you use:

<dependency>
    <groupId>org.graalvm.sdk</groupId>
    <artifactId>nativeimage</artifactId>
    <version>23.1.0</version>
</dependency>

Polyglot embedders can now use:

<dependency>
    <groupId>org.graalvm.polyglot</groupId>
    <artifactId>polyglot</artifactId>
    <version>23.1.0</version>
</dependency>

For more details, see Polyglot Embedding updates.

Find a complete list of updates in the GraalVM SDK changelog.

Polyglot Embedding

• Turned all GraalVM languages artifacts into standard Maven dependencies for polyglot embedders (see #6852). Previously, to use a GraalVM language in embeddings, you had to install it using the GraalVM Updater tool (e.g., gu install python). To enable a language now, language artifacts now need to be on the Java module or class path.
• The use of the graalvm-sdk module is now deprecated; use the org.graalvm.polyglot:polyglot artifact instead. The org.graalvm.polyglot module is no longer contained by default in the GraalVM JDK. To enable a language embedding in Java, specify the language as a dependency. If you need the Truffle tools for your polyglot application, enable them through a dependency too. Below is an example of the Maven configuration:

    <dependency>
        <groupId>org.graalvm.polyglot</groupId>
        <artifactId>polyglot</artifactId>
        <version>23.1.0</version>
    </dependency>
    <dependency>
        <groupId>org.graalvm.polyglot</groupId>
        <!-- Select the language -->
        <artifactId>js|python|ruby|wasm|llvm|java</artifactId>
        <version>23.1.0</version>
        <type>pom</type>
    </dependency>
    <dependency>
        <groupId>org.graalvm.polyglot</groupId>
        <artifactId>tools</artifactId>
        <version>23.1.0</version>
        <type>pom</type>
    </dependency>
  

  These dependencies use the language and tools built on top of Oracle GraalVM. To use the GraalVM Community Edition version, add the suffix -community to artifactId, for example, js-community. Please refer to the updated embedding languages reference documentation for further details.

• Removed the option --language:<language> (to enable a specific language runtime at build time) and some macro options, namely:

    --macro:polyglot-launcher
    --macro:polyglot-library
    --macro:truffle
    --macro:truffle-language-library
  

  They are no longer needed as putting them on the class/module-path does everything necessary.

More updates can be found in the changelog.

JavaScript and Node.js

• Released the JavaScript (GraalJS) and Node.js runtimes as standalone distributions. Two standalone language runtime options are available for both Oracle GraalVM and GraalVM Community Edition: a Native Image compiled native launcher or a JVM-based runtime (included). To distinguish between them, the GraalVM Community Edition version has the suffix -community in the name: graaljs-community-<version>-<os>-<arch>.tar.gz., graalnodejs-community-<version>-<os>-<arch>.tar.gz., A standalone that comes with a JVM has a -jvm suffix in a name. Standalone distributions are available on GitHub.
• The ScriptEngine implementation for running JavaScript is no longer shipped with GraalVM. Migrate your setup to explicitly depend on the ScriptEngine module and add it to the module path. See ScriptEngine documentation for details.
• To enable the JavaScript runtime, you no longer install it with gu install js (since GraalVM Updater is removed), but add it as a Maven dependency (see below), or explicitly put the JAR on the module path. The Maven dependency for embedding JavaScript into Java were also updated. Below is the Maven configuration for a JavaScript embedding:

    <dependency>
        <groupId>org.graalvm.polyglot</groupId>
        <artifactId>polyglot</artifactId>
        <version>23.1.0</version>
    </dependency>
    <dependency>
        <groupId>org.graalvm.polyglot</groupId>
        <artifactId>js</artifactId>
        <version>23.1.0</version>
        <type>pom</type>
    </dependency>
  

  It enables the Oracle GraalVM JavaScript runtime. To use a community-licensed version instead, add the -community suffix to each artifact (e.g., js-community). See the dependency setup for language embeddings.

• Enabled ECMAScript 2023 features by default.
• Implemented new proposals:
  • Async Context, available behind the experimental option --js.async-context.
  • String.dedent, available in ECMAScript staging mode behind the --js.ecmascript-version=staging option.
• Updated Node.js to version 18.17.1.

Find more updates in the project changelog.

Java on Truffle

• Java on Truffle (Espresso) is no longed shipped with GraalVM, but as a separate standalone distribution and a Maven artifact. Two standalone options are available: Oracle GraalVM and GraalVM Community Edition with a native launcher included. To distinguish between them, the GraalVM Community Edition version has the suffix -community in the name: espresso-community-<version>-<os>-<arch>.tar.gz. See the Java on Truffle Getting Started. Standalone distributions are available on GitHub.
• To enable Java on Truffle, you no longer install it with gu install espresso (since GraalVM Updater is removed), but add it as a Maven dependency (see below), or explicitly put the JAR on the module path.

    <dependency>
        <groupId>org.graalvm.polyglot</groupId>
        <artifactId>polyglot</artifactId>
        <version>23.1.0</version>
    </dependency>
    <dependency>
        <groupId>org.graalvm.polyglot</groupId>
        <artifactId>java</artifactId>
        <version>23.1.0</version>
        <scope>runtime</scope>
        <type>pom</type>
    </dependency>
  

  It enables the Oracle GraalVM Java on Truffle runtime.

• Added the option --enable-preview.

Find more updates in the project changelog.

LLVM

• The GraalVM LLVM runtime is no longed shipped with GraalVM, but as a separate standalone distribution. It contains the LLVM toolchain by default. Two standalone language runtime options are available for both Oracle GraalVM and GraalVM Community Edition: a Native Image compiled native launcher or a JVM-based runtime (included). To distinguish between them, the GraalVM Community Edition version has the suffix -community in the name: llvm-community-<version>-<os>-<arch>.tar.gz. A standalone that comes with a JVM has the -jvm suffix in a name. See the LLVM Getting Started. Standalone distributions are available on GitHub.
• Updated LLVM toolchain to version 16.0.1.
• Added the flang toolchain wrapper to enable Fortran compilation with embedded bitcode.

Note: The LLVM toolchain is marked as deprecated for removal in Oracle GraalVM for JDK 23.

Truffle Language and Tool Implementations

• Truffle language and tools implementations are isolated from the embedder using the Java module-based isolation. This means that they were migrated to Java modules to prevent accidental use of internal APIs. See the details of Truffle languages and instruments required modularization in this document.
• Implemented the Internal Resource API for Truffle languages and instruments to be able to lazily unpack and consume resources from the application module path, necessary for execution. This API replaces the concept of “language homes”. For a language or instrument that requires additional files to execute, it needs to follow these steps:
  • Bundle the necessary files into a standalone distribution (JAR).
  • Implement the InternalResource interface for handling the resource file unpacking.
  • Call the Env#getInternalResource method when a language or instrument needs the bundled resource files. This method ensures that the requested InternalResource is unpacked and provides a directory containing the unpacked files. Since unpacking internal resources can be an expensive operation, the implementation ensures that internal resources are cached.
• Truffle languages or instruments are now loaded from the application module path, unlike before when they were provided using -Dtruffle.class.path.append on a GraalVM JDK. The Truffle class path is deprecated and should no longer be used. Languages now need to be capable of running as named modules, so the language needs to be migrated. Languages can still be loaded from the class path, but Truffle internally loads them in its own classloader and module layer, so they are required to become modules.
• Improved Ideal Graph Visualizer dumping experience:
  • IR dumping: folders for Truffle now include the compilation tier to differentiate compilations better. Inlined IR graphs are now additionally dumped in separate folders if dump level is >= 2.
  • AST dumping: the Truffle AST is now dumped as part of the IR dump folder. The dumped AST tree now shows all inlined ASTs in a single tree. Individual functions can be grouped using the “Cluster nodes” function in IGV (top status bar). Root nodes now display their name. Every AST node now has a property graalIRNode that allows to find the corresponding Graal IR constant if there is one.

Find a complete list of updates in the Truffle changelog.