[aurelien-coet-sonarsource]

---

Summary by Gitar

• Frontend backend abstraction:
  • Added FrontendBackend, EcjFrontendBackend, and FrontendSession to own parser configuration and parse lifecycle.
  • Introduced FrontendResources so cleanup actions run on success, failure, and cancellation.
  • Added FrontendParser, FrontendConfiguration, and FrontendBatch as entry points for parsing and batch inputs.
• Batch and scanner integration:
  • JParserConfig, JavaFrontend, and JavaAstScanner now parse through sessions and owned resources.
  • JSema registers its environment cleaner on the owning resource set.
• Test infrastructure:
  • Added TestResourceScope and SemanticFixture for scoped parser fixtures in tests.
  • Added FrontendContractSnapshot and FrontendLifecycleTest to check frontend output and lifecycle behavior.
• Packaging:
  • Bundled apache.txt license text and redirected Apache license URLs in sonar-java-plugin/pom.xml.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-7259

[aurelien-coet-sonarsource]

/pvf

[hashicorp-vault-sonar-prod]

📊 Performance Validation complete
🆕 0 new · 🗑️ 0 lost issues
View dashboard

[gitar-bot]

Code Review ✅ Approved 2 closed / 2 findings

🟡 Medium risk · Refactoring parsing into backend-owned sessions changes AST and semantic resource lifecycles, which could leak or prematurely close resources during analysis.

Introduces a compiler-neutral frontend backend with scoped resource management, routing parsing through owned sessions so cleanup runs on success, failure, and cancellation. Resolved the cleaner Error handling that skipped remaining cleaners and the session leak when parsing throws an Error. No open issues found.

✅ 2 closed

✅ Bug: Cleaner Error now skips and discards all remaining cleaners

📄 java-frontend/src/main/java/org/sonar/java/model/FrontendResources.java:39-53 📄 java-checks-test-sources/test-classpath-reader/src/main/java/org/sonar/java/test/TestResourceScope.java:88-102 📄 java-frontend/src/test/java/org/sonar/java/model/FrontendLifecycleTest.java:67-79
Before this commit, FrontendResources.close() caught RuntimeException | Error, ran every cleaner, and then rethrew. Now it catches only RuntimeException. If a cleaner throws an Error (StackOverflowError, OutOfMemoryError, AssertionError, LinkageError), the loop exits right away, and the finally { cleaners.clear(); } together with closed = true drops the cleaners that haven't run yet. They can never be retried. Any RuntimeException already collected is also lost, as the new test's hasNoSuppressedExceptions() shows. In production this resource set holds every ECJ environment cleaner for a whole batch (JavaFrontend.scanBatch's environmentsCleaners, plus the session's own cleaners in Batch.parse), so one failing cleaner leaks the LookupEnvironments of every later file in the batch. That goes against the class's stated job of owning cleanup handles, and against the earlier commit's "attempts every resource" guarantee. TestResourceScope.Scope.close() got the same change: an Error from one fixture stops the remaining fixtures from closing, and resources.clear() then discards them. The commit swaps this guarantee for a quality-gate fix (S1181). A better fix is to keep catch (RuntimeException | Error e) with a justified // NOSONAR, or to wrap the loop body in try/finally so an Error still lets the remaining cleaners run.

✅ Bug: FrontendParser.parse leaks the session when parsing throws an Error

📄 java-frontend/src/main/java/org/sonar/java/model/FrontendParser.java:33-47 📄 java-frontend/src/test/java/org/sonar/java/model/FrontendLifecycleTest.java:107-118
FrontendParser.parse now catches only RuntimeException. When session.parse throws an Error, for example a StackOverflowError while converting deeply nested code, the session that backend.open opened is never closed. The caller gets no ParsedFile back, so it has no handle to close it either. For the ECJ backend, JParser.parse registers the environment cleaner before conversion runs (see ecj_registers_environment_before_syntax_conversion_failure), so that LookupEnvironment leaks. The new test parse_errors_propagate_directly asserts session.closed is zero, which writes the leak into the contract. A fix is a success flag with finally { if (!success) session.close(); } for the Error path, keeping the RuntimeException catch so cleanup failures are still added as suppressed.

Verification Repos 1 inspected · PRs 1 inspected

Functional validation No results

Rules 1 not applicable

Broader impact Repos 1 inspected PRs 1 inspected

Cross-repo 1 repository inspected 0 open impacts

SonarSource/sonar-java-symbolic-execution Inspected

Cross-PR 1 PR inspected 0 open impacts

PR 6416: SONARJAVA-7252 Decouple the Java frontend from Eclipse JDT core Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
2 Fixed issues
4 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
93.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube