Fix and ensure Java 8/11 compatibility of prebuilt Java tools

Prebuilt Java tools meant to run on the user-specified `--java_{tool_,}runtime_version` must only use Java 8 language features and APIs. Previously, these tools were compiled with `--java_language_version=8`, but had access to a JDK 21 as the bootclasspath. In fact, `junitrunner` used `Stream#dropWhile`, which isn't available in a JDK 8.
Similarly, Java tools meant to run on the Java runtime provided by a Java (compilation) toolchain must only use Java 11 language features and APIs. This was the case, but they were in fact build with `--java_language_version=8` and a JDK 21, just like the other tools, thus lacking validation for this property.

This PR splits tools into two groups and enforces consistent Java language and bootclasspath runtime for them via `--@rules_java//toolchains:incompatible_language_version_bootclasspath`. Constants in `//src:release_archive.bzl` can be used to set the two minimum versions globally.

Author: fmeum

.bazelrc

@@ -52,10 +52,13 @@ build:windows --per_file_copt=external/.*@/w
 build:windows --host_per_file_copt=external/.*@/w
 
 # Enable Java 21 language features
-build --java_runtime_version=21
-build --java_language_version=21
-build --tool_java_language_version=21
-build --tool_java_runtime_version=21
+common --java_runtime_version=21
+common --java_language_version=21
+common --tool_java_language_version=21
+common --tool_java_runtime_version=21
+# Ensure that Java language level and bootclasspath version are the same.
+# This avoids accidental usage of more recent Java APIs.
+common --@rules_java//toolchains:incompatible_language_version_bootclasspath
 
 # User-specific .bazelrc
 try-import %workspace%/user.bazelrc

src/BUILD

@@ -6,8 +6,7 @@ load("@rules_cc//cc:cc_binary.bzl", "cc_binary")
 load("@rules_java//java:java_binary.bzl", "java_binary")
 load("@rules_python//python:defs.bzl", "py_binary", "py_library")
 load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
-load("//src:build_defs.bzl", "transition_java_language_8_archive")
-load("//src:release_archive.bzl", "release_archive")
+load("//src:release_archive.bzl", "minimum_java_compilation_runtime_filegroup", "minimum_java_runtime_filegroup", "release_archive")
 load(":embedded_tools.bzl", "srcsfile")
 load(":rule_size_test.bzl", "rule_size_test")
 
@@ -512,19 +511,33 @@ genrule(
 )
 
 # Following targets build java_tools.zip - platform independent part of java_tools
-JAVA_TOOLS_DEPLOY_JARS = [
-    "//src/java_tools/buildjar:JavaBuilder_deploy.jar",
-    "//src/java_tools/buildjar:VanillaJavaBuilder_deploy.jar",
-    "//src/java_tools/buildjar/java/com/google/devtools/build/buildjar/genclass:GenClass_deploy.jar",
-    "//src/java_tools/buildjar/java/com/google/devtools/build/java/turbine:turbine_direct_binary_deploy.jar",
-    "//src/java_tools/import_deps_checker/java/com/google/devtools/build/importdeps:ImportDepsChecker_deploy.jar",
-    "//src/java_tools/junitrunner/java/com/google/testing/coverage:JacocoCoverage_jarjar_deploy.jar",
-    "//src/java_tools/junitrunner/java/com/google/testing/junit/runner:Runner_deploy.jar",
-]
+minimum_java_runtime_filegroup(
+    name = "minimum_java_runtime_tools",
+    srcs = [
+        "//src/java_tools/junitrunner/java/com/google/testing/coverage:JacocoCoverage_jarjar_deploy.jar",
+        "//src/java_tools/junitrunner/java/com/google/testing/junit/runner:Runner_deploy.jar",
+    ],
+    visibility = ["//visibility:private"],
+)
+
+minimum_java_compilation_runtime_filegroup(
+    name = "minimum_java_compilation_runtime_tools",
+    srcs = [
+        "//src/java_tools/buildjar:JavaBuilder_deploy.jar",
+        "//src/java_tools/buildjar:VanillaJavaBuilder_deploy.jar",
+        "//src/java_tools/buildjar/java/com/google/devtools/build/buildjar/genclass:GenClass_deploy.jar",
+        "//src/java_tools/buildjar/java/com/google/devtools/build/java/turbine:turbine_direct_binary_deploy.jar",
+        "//src/java_tools/import_deps_checker/java/com/google/devtools/build/importdeps:ImportDepsChecker_deploy.jar",
+    ],
+    visibility = ["//visibility:private"],
+)
 
 release_archive(
     name = "jars_java_tools_zip",
-    srcs = JAVA_TOOLS_DEPLOY_JARS,
+    srcs = [
+        ":minimum_java_compilation_runtime_tools",
+        ":minimum_java_runtime_tools",
+    ],
     package_dir = "java_tools",
     visibility = ["//visibility:private"],
 )
@@ -545,12 +558,6 @@ release_archive(
     ],
 )
 
-transition_java_language_8_archive(
-    name = "java_tools_java8.zip",
-    archive_zip = ":java_tools.zip",
-    visibility = ["//src/test/shell/bazel:__pkg__"],
-)
-
 release_archive(
     name = "turbine_direct_graal_zip",
     srcs = ["//src/java_tools/buildjar/java/com/google/devtools/build/java/turbine:turbine_direct_graal"],
@@ -573,12 +580,6 @@ release_archive(
     ],
 )
 
-transition_java_language_8_archive(
-    name = "java_tools_prebuilt_java8.zip",
-    archive_zip = ":java_tools_prebuilt.zip",
-    visibility = ["//src/test/shell/bazel:__pkg__"],
-)
-
 # Following targets used by the java_tools_binaries Buildkite pipeline to upload
 # the java_tools_*.zip to either tmp/sources or tmp/build directories in GCS.
 sh_binary(
@@ -664,11 +665,6 @@ filegroup(
     ],
 )
 
-bzl_library(
-    name = "build_defs_bzl",
-    srcs = ["build_defs.bzl"],
-)
-
 java_binary(
     name = "CheckSunJnuEncoding",
     srcs = ["CheckSunJnuEncoding.java"],

src/build_defs.bzl

@@ -297,8 +297,7 @@ private static void setLocations(JavacFileManager fileManager, BlazeJavacArgumen
     try {
       fileManager.setLocationFromPaths(StandardLocation.CLASS_PATH, arguments.classPath());
       // modular dependencies must be on the module path, not the classpath
-      fileManager.setLocationFromPaths(
-          StandardLocation.locationFor("MODULE_PATH"), arguments.classPath());
+      fileManager.setLocationFromPaths(StandardLocation.MODULE_PATH, arguments.classPath());
 
       fileManager.setLocationFromPaths(
           StandardLocation.CLASS_OUTPUT, ImmutableList.of(arguments.classOutput()));
@@ -326,7 +325,7 @@ private static void setLocations(JavacFileManager fileManager, BlazeJavacArgumen
       Path system = arguments.system();
       if (system != null) {
         fileManager.setLocationFromPaths(
-            StandardLocation.locationFor("SYSTEM_MODULES"), ImmutableList.of(system));
+            StandardLocation.SYSTEM_MODULES, ImmutableList.of(system));
       }
       // The bootclasspath may legitimately be empty if --release is being used.
       Collection<Path> bootClassPath = arguments.bootClassPath();

src/java_tools/buildjar/java/com/google/devtools/build/buildjar/javac/BlazeJavacMain.java

@@ -14,10 +14,8 @@
 
 package com.google.testing.junit.runner.internal;
 
-import static java.util.Arrays.stream;
-import static java.util.stream.Collectors.toList;
-
 import java.io.PrintStream;
+import java.util.ArrayList;
 import java.util.List;
 
 /**
@@ -28,40 +26,41 @@
  */
 public class SystemExitDetectingShutdownHook {
   public static Thread newShutdownHook(PrintStream testRunnerOut) {
-    Runnable hook = () -> {
-      boolean foundRuntimeExit = false;
-      for (StackTraceElement[] stack : Thread.getAllStackTraces().values()) {
-        @SuppressWarnings("JdkCollectors") // can't use ImmutableList here
-        List<String> framesStartingWithRuntimeExit =
-            stream(stack)
-                .dropWhile(
-                    frame ->
-                        !frame.getClassName().equals("java.lang.Runtime")
-                            || !frame.getMethodName().equals("exit"))
-                .map(SystemExitDetectingShutdownHook::frameString)
-                .collect(toList());
-        if (!framesStartingWithRuntimeExit.isEmpty()) {
-          foundRuntimeExit = true;
-          testRunnerOut.println("\nSystem.exit or Runtime.exit was called!");
-          testRunnerOut.println(String.join("\n", framesStartingWithRuntimeExit));
-        }
-      }
-      if (foundRuntimeExit) {
-        // We must call halt rather than exit, because exit would lead to a deadlock. We use a
-        // hopefully unique exit code to make it easier to identify this case.
-        Runtime.getRuntime().halt(121);
-      }
-    };
+    Runnable hook =
+        () -> {
+          boolean foundRuntimeExit = false;
+          for (StackTraceElement[] stack : Thread.getAllStackTraces().values()) {
+            List<String> framesStartingWithRuntimeExit = new ArrayList<>();
+            boolean foundRuntimeExitInThisThread = false;
+            for (StackTraceElement frame : stack) {
+              if (!foundRuntimeExitInThisThread
+                  && frame.getClassName().equals("java.lang.Runtime")
+                  && frame.getMethodName().equals("exit")) {
+                foundRuntimeExitInThisThread = true;
+              }
+              if (foundRuntimeExitInThisThread) {
+                framesStartingWithRuntimeExit.add(frameString(frame));
+              }
+            }
+            if (foundRuntimeExitInThisThread) {
+              foundRuntimeExit = true;
+              testRunnerOut.println("\nSystem.exit or Runtime.exit was called!");
+              testRunnerOut.println(String.join("\n", framesStartingWithRuntimeExit));
+            }
+          }
+          if (foundRuntimeExit) {
+            // We must call halt rather than exit, because exit would lead to a deadlock. We use a
+            // hopefully unique exit code to make it easier to identify this case.
+            Runtime.getRuntime().halt(121);
+          }
+        };
     return new Thread(hook, "SystemExitDetectingShutdownHook");
   }
 
   private static String frameString(StackTraceElement frame) {
     return String.format(
         "        at %s.%s(%s:%d)",
-        frame.getClassName(),
-        frame.getMethodName(),
-        frame.getFileName(),
-        frame.getLineNumber());
+        frame.getClassName(), frame.getMethodName(), frame.getFileName(), frame.getLineNumber());
   }
 
   private SystemExitDetectingShutdownHook() {}

src/java_tools/junitrunner/java/com/google/testing/junit/runner/internal/SystemExitDetectingShutdownHook.java

@@ -14,6 +14,37 @@
 
 """Rules to create a release archive"""
 
+load("@rules_java//java:java_binary.bzl", "java_binary")
+load("@with_cfg.bzl", "with_cfg")
+
+# The minimum --java_{tool_,}runtime_version supported by prebuilt Java tools.
+_MINIMUM_JAVA_RUNTIME_VERSION = 8
+
+# The minimum version of a java_toolchain's java_runtime supported by prebuilt Java tools.
+_MINIMUM_JAVA_COMPILATION_RUNTIME_VERSION = 11
+
+minimum_java_runtime_java_binary, _minimum_java_runtime_java_binary = (
+    # Don't warn about targeting very old Java versions.
+    with_cfg(java_binary)
+        .set("java_language_version", str(_MINIMUM_JAVA_RUNTIME_VERSION))
+        .extend("javacopt", ["-Xlint:-options"])
+        .build()
+)
+
+minimum_java_runtime_filegroup, _minimum_java_runtime_filegroup = (
+    # Don't warn about targeting very old Java versions.
+    with_cfg(native.filegroup)
+        .set("java_language_version", str(_MINIMUM_JAVA_RUNTIME_VERSION))
+        .extend("javacopt", ["-Xlint:-options"])
+        .build()
+)
+
+minimum_java_compilation_runtime_filegroup, _minimum_java_compilation_runtime_filegroup = (
+    with_cfg(native.filegroup)
+        .set("java_language_version", str(_MINIMUM_JAVA_COMPILATION_RUNTIME_VERSION))
+        .build()
+)
+
 def release_archive(name, srcs = [], src_map = {}, package_dir = "-", deps = [], **kwargs):
     """ Creates an zip of the srcs, and renamed label artifacts.
 

src/release_archive.bzl

@@ -233,18 +233,14 @@ sh_test(
     srcs = ["bazel_java17_test.sh"],
     args = [
         # java_tools zip to test
-        "$(rlocationpath //src:java_tools_java8.zip)",
-        "$(rlocationpath //src:java_tools_prebuilt_java8.zip)",
+        "$(rlocationpath //src:java_tools.zip)",
+        "$(rlocationpath //src:java_tools_prebuilt.zip)",
     ],
     data = [
         ":gen_rules_java_repo_name",
         ":test-deps",
-        # Use java_tools compiled at Java language 8 instead (aligned with the
-        # default compilation level of java_tools). For the purpose
-        # of this test, we need java_tools to be running with runtime >11 to
-        # test the failure modes of incompatible system classpaths.
-        "//src:java_tools_prebuilt_java8.zip",
-        "//src:java_tools_java8.zip",
+        "//src:java_tools.zip",
+        "//src:java_tools_prebuilt.zip",
         "@bazel_tools//tools/bash/runfiles",
     ],
     tags = ["local"],
@@ -294,8 +290,8 @@ JAVA_VERSIONS_COVERAGE = ("11", "17", "21")
         srcs = ["bazel_java_test.sh"],
         args = [
             # java_tools zips to test
-            "$(rlocationpath %s)" % ("//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip"),
-            "$(rlocationpath %s)" % ("//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip"),
+            "$(rlocationpath //src:java_tools_zip)",
+            "$(rlocationpath //src:java_tools_zip)",
             # --java_language_version value
             java_version,
             # --java_runtime_version value
@@ -304,8 +300,8 @@ JAVA_VERSIONS_COVERAGE = ("11", "17", "21")
         data = [
             ":gen_rules_java_repo_name",
             ":test-deps",
-            "//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip",
-            "//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip",
+            "//src:java_tools_prebuilt_zip",
+            "//src:java_tools_zip",
             "@bazel_tools//tools/bash/runfiles",
         ],
         exec_compatible_with = ["//:highcpu_machine"],
@@ -560,8 +556,8 @@ sh_test(
         srcs = ["bazel_coverage_java_test.sh"],
         args = [
             # java_tools zips to test
-            "$(rlocationpath %s)" % ("//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip"),
-            "$(rlocationpath %s)" % ("//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip"),
+            "$(rlocationpath //src:java_tools_zip)",
+            "$(rlocationpath //src:java_tools_prebuilt_zip)",
             # WORKSPACE file of the coverage output generator repo to test
             "$(rlocationpath //tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_empty_workspace)",
             # --java_runtime_version value
@@ -570,10 +566,10 @@ sh_test(
         data = [
             ":gen_rules_java_repo_name",
             ":test-deps",
-            "//src:java_tools_prebuilt_zip" if java_version == "21" else "//src:java_tools_prebuilt_java8.zip",
-            "//src:java_tools_zip" if java_version == "21" else "//src:java_tools_java8.zip",
+            "//src:java_tools_prebuilt_zip",
+            "//src:java_tools_zip",
             "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_empty_workspace",
-            "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo%s" % ("" if java_version == "21" else "_java8"),
+            "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo",
         ],
         tags = ["no_windows"],
     )
@@ -628,7 +624,7 @@ sh_test(
     data = [
         ":test-deps",
         "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_empty_workspace",
-        "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo_java8",
+        "//tools/test/CoverageOutputGenerator/java/com/google/devtools/coverageoutputgenerator:coverage_output_generator_repo",
     ],
     tags = [
         "no_windows",

src/test/shell/bazel/BUILD

@@ -58,7 +58,7 @@ commit_hash=$(git rev-parse HEAD)
 timestamp=$(date +%s)
 bazel_version=$(bazel info release | cut -d' ' -f2)
 
-RELEASE_BUILD_OPTS="-c opt --tool_java_language_version=8 --java_language_version=8"
+RELEASE_BUILD_OPTS="-c opt"
 
 # Check that the build machine is set up for Unicode.
 bazel run ${RELEASE_BUILD_OPTS} //src:CheckSunJnuEncoding