Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dependency conflicts on org.ow2.asm:asm, leading to invoking unexpected methods #144

Open
HelloCoCooo opened this issue Jan 18, 2020 · 1 comment
Open

Dependency conflicts on org.ow2.asm:asm, leading to invoking unexpected methods #144

HelloCoCooo opened this issue Jan 18, 2020 · 1 comment

Comments

@HelloCoCooo
Copy link

HelloCoCooo commented Jan 18, 2020 •
edited
Loading

Hi, @skyesx in EasyTransaction-1.4.2 (easytrans-core module), duplicate classes with the same fully-qualified name org.objectweb.asm.ClassWriter are included in two different libraries, i.e., org.ow2.asm:asm:5.0.4 and org.ow2.asm:asm:4.2.

According to "first declaration wins" class loading strategy, only this class in org.ow2.asm:asm:4.2 can be loaded, and that in org.ow2.asm:asm:5.0.4 will be shadowed.

By further analyzing, your project expects to invoke method <org.objectweb.asm.ClassWriter: toByteArray()[B> in org.ow2.asm:asm:5.0.4. As it has been shadowed, so that this method defined in org.ow2.asm:asm:4.2 is actually forced to be referenced via the following invocation path:

<com.yiqiniu.easytrans.protocol.autocps.EtDataSourceManager: access$100(Lcom/yiqiniu/easytrans/protocol/autocps/EtDataSourceManager;Ljava/lang/String;JLjava/sql/Connection;Ljava/util/List;Ljava/lang/String;)V> /home/wwww/sensor/unzip/EasyTransaction-1.4.2/easytrans-core/target/classes
<com.yiqiniu.easytrans.protocol.autocps.EtDataSourceManager: cleanLocks(Ljava/lang/String;JLjava/sql/Connection;Ljava/util/List;Ljava/lang/String;)V> /home/wwww/sensor/unzip/EasyTransaction-1.4.2/easytrans-core/target/classes
<io.seata.rm.datasource.undo.parser.KryoUndoLogParser: decode([B)Lio/seata/rm/datasource/undo/BranchUndoLog;> /home/wwww/.m2/repository/io/seata/seata-rm-datasource/0.8.1/seata-rm-datasource-0.8.1.jar
<io.seata.rm.datasource.undo.parser.KryoSerializer: deserialize([B)Ljava/lang/Object;> /home/wwww/.m2/repository/io/seata/seata-rm-datasource/0.8.1/seata-rm-datasource-0.8.1.jar
<com.esotericsoftware.kryo.Kryo: readClassAndObject(Lcom/esotericsoftware/kryo/io/Input;)Ljava/lang/Object;> /home/wwww/.m2/repository/com/esotericsoftware/kryo/4.0.2/kryo-4.0.2.jar
<com.esotericsoftware.kryo.serializers.FieldSerializer: setGenerics(Lcom/esotericsoftware/kryo/Kryo;[Ljava/lang/Class;)V> /home/wwww/.m2/repository/com/esotericsoftware/kryo/4.0.2/kryo-4.0.2.jar
<com.esotericsoftware.kryo.serializers.FieldSerializer: rebuildCachedFields(Z)V> /home/wwww/.m2/repository/com/esotericsoftware/kryo/4.0.2/kryo-4.0.2.jar
<com.esotericsoftware.reflectasm.FieldAccess: get(Ljava/lang/Class;)Lcom/esotericsoftware/reflectasm/FieldAccess;> /home/wwww/.m2/repository/com/esotericsoftware/reflectasm/1.11.3/reflectasm-1.11.3.jar
<org.objectweb.asm.ClassWriter: toByteArray()[B>

Although both of these two conflicting classes contain the referenced methods (with the same signature), they have different implementations. This issue will not lead to runtime crashes, but it can introduce inconsistent semantic hehavior by changing the control flows and data flows.

Workaround solution:
An easy way to workaround the problem is reversing the declaration order of these two libraries in pom file.
Then, according to "first declaration wins" class loading strategy, class org.objectweb.asm.ClassWriter in org.ow2.asm:asm:5.0.4 can be loaded (the version that EasyTransaction expects to reference by static analysis).
This fix will not affect other libraries or class, except the above duplicate class.

Dependency tree--
[INFO] com.yiqiniu.easytrans:easytrans-core:jar:1.4.2
[INFO] +- org.springframework.boot:spring-boot:jar:1.5.19.RELEASE:compile
[INFO] | +- (org.springframework:spring-core:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | - org.springframework:spring-context:jar:4.3.22.RELEASE:compile
[INFO] | +- org.springframework:spring-aop:jar:4.3.22.RELEASE:compile
[INFO] | | +- (org.springframework:spring-beans:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | | - (org.springframework:spring-core:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-beans:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-core:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | - org.springframework:spring-expression:jar:4.3.22.RELEASE:compile
[INFO] | - (org.springframework:spring-core:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] +- org.springframework.boot:spring-boot-autoconfigure:jar:1.5.19.RELEASE:compile
[INFO] | - (org.springframework.boot:spring-boot:jar:1.5.19.RELEASE:compile - omitted for duplicate)
[INFO] +- org.springframework:spring-core:jar:4.3.22.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-configuration-processor:jar:1.5.19.RELEASE:compile
[INFO] +- org.springframework:spring-jdbc:jar:4.3.22.RELEASE:compile
[INFO] | +- org.springframework:spring-beans:jar:4.3.22.RELEASE:compile
[INFO] | | - (org.springframework:spring-core:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-core:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | - org.springframework:spring-tx:jar:4.3.22.RELEASE:compile
[INFO] | +- (org.springframework:spring-beans:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] | - (org.springframework:spring-core:jar:4.3.22.RELEASE:compile - omitted for duplicate)
[INFO] +- io.seata:seata-rm-datasource:jar:0.8.1:compile
[INFO] | +- io.seata:seata-core:jar:0.8.1:compile
[INFO] | | +- io.seata:seata-common:jar:0.8.1:compile
[INFO] | | | +- (io.netty:netty-all:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | | +- (org.slf4j:slf4j-api:jar:1.7.25:compile - version managed from 1.6.1; omitted for duplicate)
[INFO] | | | +- ch.qos.logback:logback-classic:jar:1.1.11:compile (version managed from 1.2.0)
[INFO] | | | | +- ch.qos.logback:logback-core:jar:1.1.11:compile
[INFO] | | | | - (org.slf4j:slf4j-api:jar:1.7.25:compile - version managed from 1.7.22; omitted for duplicate)
[INFO] | | | +- commons-lang:commons-lang:jar:2.6:compile
[INFO] | | | - (com.alibaba:fastjson:jar:1.2.60:compile - omitted for duplicate)
[INFO] | | +- io.seata:seata-discovery-core:jar:0.8.1:compile
[INFO] | | | - io.seata:seata-config-core:jar:0.8.1:compile
[INFO] | | | +- (io.seata:seata-common:jar:0.8.1:compile - omitted for duplicate)
[INFO] | | | - com.typesafe:config:jar:1.2.1:compile
[INFO] | | +- com.alibaba:fastjson:jar:1.2.60:compile
[INFO] | | +- io.netty:netty-all:jar:4.1.30.Final:compile
[INFO] | | +- org.apache.commons:commons-pool2:jar:2.4.3:compile (version managed from 2.4.2)
[INFO] | | +- commons-pool:commons-pool:jar:1.6:compile
[INFO] | | +- (com.google.guava:guava:jar:18.0:compile - version managed from 20.0; omitted for duplicate)
[INFO] | | - com.google.protobuf:protobuf-java:jar:3.7.1:compile
[INFO] | +- io.seata:seata-rm:jar:0.8.1:compile
[INFO] | | +- (io.seata:seata-core:jar:0.8.1:compile - omitted for duplicate)
[INFO] | | - cglib:cglib:jar:3.1:compile
[INFO] | | - org.ow2.asm:asm:jar:4.2:compile
[INFO] | +- com.alibaba:druid:jar:1.1.12:compile
[INFO] | +- com.github.ben-manes.caffeine:caffeine:jar:2.3.5:compile (version managed from 2.7.0)
[INFO] | +- io.protostuff:protostuff-core:jar:1.5.9:compile
[INFO] | | - io.protostuff:protostuff-api:jar:1.5.9:compile
[INFO] | +- io.protostuff:protostuff-runtime:jar:1.5.9:compile
[INFO] | | +- (io.protostuff:protostuff-api:jar:1.5.9:compile - omitted for duplicate)
[INFO] | | - io.protostuff:protostuff-collectionschema:jar:1.5.9:compile
[INFO] | | - (io.protostuff:protostuff-api:jar:1.5.9:compile - omitted for duplicate)
[INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.11.3:compile (version managed from 2.9.8)
[INFO] | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile
[INFO] | | - com.fasterxml.jackson.core:jackson-core:jar:2.8.11:compile (version managed from 2.8.10)
[INFO] | +- com.esotericsoftware:kryo:jar:4.0.2:compile
[INFO] | | +- com.esotericsoftware:reflectasm:jar:1.11.3:compile
[INFO] | | | - (org.ow2.asm:asm:jar:5.0.4:compile - omitted for conflict with 4.2)
[INFO] | | +- com.esotericsoftware:minlog:jar:1.3.0:compile
[INFO] | | - org.objenesis:objenesis:jar:2.5.1:compile
[INFO] | - de.javakaffee:kryo-serializers:jar:0.42:compile
[INFO] | - (com.esotericsoftware:kryo:jar:4.0.0:compile - omitted for conflict with 4.0.2)
[INFO] +- commons-logging:commons-logging-api:jar:1.1:provided
[INFO] +- org.apache.curator:curator-recipes:jar:4.0.1:compile
[INFO] | - org.apache.curator:curator-framework:jar:4.0.1:compile
[INFO] | - org.apache.curator:curator-client:jar:4.0.1:compile
[INFO] | +- (com.google.guava:guava:jar:18.0:compile - version managed from 20.0; omitted for duplicate)
[INFO] | - (org.slf4j:slf4j-api:jar:1.7.25:compile - version managed from 1.7.6; omitted for duplicate)
[INFO] +- org.apache.zookeeper:zookeeper:jar:3.4.10:compile
[INFO] | +- org.slf4j:slf4j-api:jar:1.7.25:compile
[INFO] | +- log4j:log4j:jar:1.2.16:compile
[INFO] | +- jline:jline:jar:0.9.94:compile
[INFO] | | - junit:junit:jar:4.12:compile (version managed from 3.8.1)
[INFO] | | - org.hamcrest:hamcrest-core:jar:1.3:compile
[INFO] | - io.netty:netty:jar:3.10.5.Final:compile
[INFO] - com.google.guava:guava:jar:18.0:compile

Thank you very much.
Best,
Coco
@HelloCoCooo
Copy link
Author

Code snippet of :<org.objectweb.asm.ClassWriter: toByteArray()[B> in org.ow2.asm:asm:5.0.4 (shadowed but expected to invoke method):

if (ClassReader.ANNOTATIONS && ianns != null) {		//line:881
  ++attributeCount;
  size += 8 + ianns.getSize();
  newUTF8("RuntimeInvisibleAnnotations");
}
if (ClassReader.ANNOTATIONS && tanns != null) {
  ++attributeCount;
  size += 8 + tanns.getSize();
  newUTF8("RuntimeVisibleTypeAnnotations");
}
if (ClassReader.ANNOTATIONS && itanns != null) {
  ++attributeCount;
  size += 8 + itanns.getSize();
  newUTF8("RuntimeInvisibleTypeAnnotations");
}
...
if (ClassReader.ANNOTATIONS && ianns != null) {		//line:965
  out.putShort(newUTF8("RuntimeInvisibleAnnotations"));
  ianns.put(out);
}
if (ClassReader.ANNOTATIONS && tanns != null) {
  out.putShort(newUTF8("RuntimeVisibleTypeAnnotations"));
  tanns.put(out);
}
if (ClassReader.ANNOTATIONS && itanns != null) {
  out.putShort(newUTF8("RuntimeInvisibleTypeAnnotations"));
  itanns.put(out);
}

Code snippet of :<org.objectweb.asm.ClassWriter: toByteArray()[B> in org.ow2.asm:asm:4.2 (loaded version):

if (ClassReader.ANNOTATIONS && ianns != null) {		//line:829
  ++attributeCount;
  size += 8 + ianns.getSize();
  newUTF8("RuntimeInvisibleAnnotations");
}
...
if (ClassReader.ANNOTATIONS && ianns != null) {		//line:903
  out.putShort(newUTF8("RuntimeInvisibleAnnotations"));
  ianns.put(out);
}

As a result, these conflicting method included in org.ow2.asm:asm:jar:5.0.4 deals with different cases, which changes the control flows and data flows. So being forced to use these methods in org.ow2.asm:asm:4.2 may lead to inconsisitent semantic behaviors.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@HelloCoCooo