Wrong entry may be loaded from multi-release jar files resulting in a NoClassDefFoundError

[karesti]

When we build a simple application using Infinispan 9.4.4.Final or above and Spring-Boot 2.1.x.RELEASE, we package it with spring-boot:repackage and then run it using java -jar in Java 11, the application won't start:

Caused by: java.lang.NoClassDefFoundError: org/infinispan/commons/util/FastCopyHashMap$Values (wrong name: org/infinispan/commons/dataconversion/BinaryEncoder)
	at java.base/java.lang.ClassLoader.defineClass1(Native Method) ~[na:na]
	at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1016) ~[na:na]
	at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174) ~[na:na]
	at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:550) ~[na:na]
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:458) ~[na:na]
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:452) ~[na:na]
	at java.base/java.security.AccessController.doPrivileged(Native Method) ~[na:na]
	at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:451) ~[na:na]
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:588) ~[na:na]
	at org.springframework.boot.loader.LaunchedURLClassLoader.loadClass(LaunchedURLClassLoader.java:93) ~[infinispan-spring-boot-sample-embedded-2.1.4-SNAPSHOT.jar:na]
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521) ~[na:na]
	at org.infinispan.factories.EncoderRegistryFactory.construct(EncoderRegistryFactory.java:48) ~[infinispan-core-9.4.7.Final.jar!/:9.4.7.Final]
	at org.infinispan.factories.impl.BasicComponentRegistryImpl.instantiateWrapper(BasicComponentRegistryImpl.java:137) ~[infinispan-core-9.4.7.Final.jar!/:9.4.7.Final]
	... 137 common frames omitted

Reproducer: https://github.com/ben-schroeder/infinispan-ncdfe
Our Issue for further details: https://issues.jboss.org/browse/ISPN-9977
StackOverflow question : https://stackoverflow.com/questions/54635814/why-does-infinispan-fail-with-noclassdeffounderror-on-spring-boot-java-11

The infinispan-commons 9.4.3.Final jar seems to work because this jar is not a multi-release jar (and should be). In any case, Spring Boot 2.1.x and Spring 5 are supported from version 9.4.4.Final.

[tristantarrant]

I patched org.springframework.boot.loader.jar.JarFileEntries to print out entries and their indexes as they are loaded. For the infinispan-commons-9.4.7.jar I got the following:

326 org/infinispan/commons/dataconversion/BinaryEncoder.class
348 org/infinispan/commons/dataconversion/BinaryEncoder.class

However that class file is present only once in the jar. It seems like it is misinterpreting the central directory index: the second entry is actually FastCopyHashMap$Values, which ultimately makes the ClassLoader.defineClass checks fail

[wilkinsona]

There's a bug in the handling of multi-release jar files that means that it doesn't handle a clash in the index generated from an entry's hash correctly. When we're looking for a multi-release entry, the named is aliased so that an entry found beneath META-INF/versions/<version>/<name> appears to actually be called <name>. The alias is applied too early which means that when we check that the entry we got back actually has the name that we expect it appears that it does when, in fact, due to the clash of indexes, it does not.