Upgrade to ASM 9.9.1 and Objenesis 3.5

Closes gh-36244

(cherry picked from commit 40350653e1)

framework-docs/src/docs/dist/license.txt

@@ -200,6 +200,7 @@
    See the License for the specific language governing permissions and
    limitations under the License.
 
+
 =======================================================================
 
 SPRING FRAMEWORK ${version} SUBCOMPONENTS:
@@ -212,7 +213,7 @@ code for these subcomponents is subject to the terms and
 conditions of the following licenses.
 
 
->>> ASM 9.1 (org.ow2.asm:asm:9.1, org.ow2.asm:asm-commons:9.1):
+>>> ASM 9.9.1 (org.ow2.asm:asm:9.9.1):
 
 Copyright (c) 2000-2011 INRIA, France Telecom
 All rights reserved.
@@ -249,10 +250,8 @@ Copyright (c) 1999-2009, OW2 Consortium <https://www.ow2.org/>
 
 >>> CGLIB 3.3 (cglib:cglib:3.3):
 
-Per the LICENSE file in the CGLIB JAR distribution downloaded from
-https://github.com/cglib/cglib/releases/download/RELEASE_3_3_0/cglib-3.3.0.jar,
-CGLIB 3.3 is licensed under the Apache License, version 2.0, the text of which
-is included above.
+Per the LICENSE file in the CGLIB distribution, CGLIB 3.3 is licensed
+under the Apache License, version 2.0, the text of which is included above.
 
 
 >>> JavaPoet 1.13.0 (com.squareup:javapoet:1.13.0):
@@ -263,18 +262,18 @@ JavaPoet 1.13.0 is licensed under the Apache License, version 2.0, the text of
 which is included above.
 
 
->>> Objenesis 3.4 (org.objenesis:objenesis:3.4):
+>>> Objenesis 3.5 (org.objenesis:objenesis:3.5):
 
-Per the LICENSE file in the Objenesis ZIP distribution downloaded from
-http://objenesis.org/download.html, Objenesis 3.4 is licensed under the
+Per the LICENSE file in the Objenesis distribution downloaded from
+http://objenesis.org/download.html, Objenesis 3.5 is licensed under the
 Apache License, version 2.0, the text of which is included above.
 
-Per the NOTICE file in the Objenesis ZIP distribution downloaded from
+Per the NOTICE file in the Objenesis distribution downloaded from
 http://objenesis.org/download.html and corresponding to section 4d of the
 Apache License, Version 2.0, in this case for Objenesis:
 
 Objenesis
-Copyright 2006-2019 Joe Walnes, Henri Tremblay, Leonardo Mesquita
+Copyright 2006-2026 Joe Walnes, Henri Tremblay, Leonardo Mesquita
 
 
 ===============================================================================

spring-core/spring-core.gradle

@@ -15,7 +15,7 @@ multiRelease {
 }
 
 def javapoetVersion = "1.13.0"
-def objenesisVersion = "3.4"
+def objenesisVersion = "3.5"
 
 configurations {
 	java21Api.extendsFrom(api)

spring-core/src/main/java/org/springframework/asm/Attribute.java

@@ -95,7 +95,7 @@ public class Attribute {
    *     a Code attribute that contains labels.
    * @deprecated no longer used by ASM.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   protected Label[] getLabels() {
     return new Label[0];
   }
@@ -174,6 +174,7 @@ public class Attribute {
    * ClassReader overrides {@link ClassReader#readLabel}. Hence {@link #read(ClassReader, int, int,
    * char[], int, Label[])} must not manually create {@link Label} instances.
    *
+   * @param classReader the class that contains the attribute to be read.
    * @param bytecodeOffset a bytecode offset in a method.
    * @param labels the already created labels, indexed by their offset. If a label already exists
    *     for bytecodeOffset this method does not create a new one. Otherwise it stores the new label

spring-core/src/main/java/org/springframework/asm/ClassReader.java

@@ -100,7 +100,7 @@ public class ClassReader {
    * @deprecated Use {@link #readByte(int)} and the other read methods instead. This field will
    *     eventually be deleted.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   // DontCheck(MemberName): can't be renamed (for backward binary compatibility).
   public final byte[] b;
 
@@ -197,7 +197,7 @@ public class ClassReader {
     // Check the class' major_version. This field is after the magic and minor_version fields, which
     // use 4 and 2 bytes respectively.
     // SPRING PATCH: leniently try to parse newer class files as well
-    // if (checkClassVersion && readShort(classFileOffset + 6) > Opcodes.V26) {
+    // if (checkClassVersion && readShort(classFileOffset + 6) > Opcodes.V27) {
     //   throw new IllegalArgumentException(
     //       "Unsupported class file major version " + readShort(classFileOffset + 6));
     // }
@@ -3550,6 +3550,9 @@ public class ClassReader {
       final char[] charBuffer,
       final int codeAttributeOffset,
       final Label[] labels) {
+    if (length > classFileBuffer.length - offset) {
+      throw new IllegalArgumentException();
+    }
     for (Attribute attributePrototype : attributePrototypes) {
       if (attributePrototype.type.equals(type)) {
         return attributePrototype.read(

spring-core/src/main/java/org/springframework/asm/ClassWriter.java

@@ -897,7 +897,7 @@ public class ClassWriter extends ClassVisitor {
    * @deprecated this method is superseded by {@link #newHandle(int, String, String, String,
    *     boolean)}.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public int newHandle(
       final int tag, final String owner, final String name, final String descriptor) {
     return newHandle(tag, owner, name, descriptor, tag == Opcodes.H_INVOKEINTERFACE);

spring-core/src/main/java/org/springframework/asm/Handle.java

@@ -71,7 +71,7 @@ public final class Handle {
    * @deprecated this constructor has been superseded by {@link #Handle(int, String, String, String,
    *     boolean)}.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public Handle(final int tag, final String owner, final String name, final String descriptor) {
     this(tag, owner, name, descriptor, tag == Opcodes.H_INVOKEINTERFACE);
   }

spring-core/src/main/java/org/springframework/asm/MethodVisitor.java

@@ -414,7 +414,7 @@ public abstract class MethodVisitor {
    * @param descriptor the method's descriptor (see {@link Type}).
    * @deprecated use {@link #visitMethodInsn(int, String, String, String, boolean)} instead.
    */
-  @Deprecated
+  @Deprecated(forRemoval = false)
   public void visitMethodInsn(
       final int opcode, final String owner, final String name, final String descriptor) {
     int opcodeAndSource = opcode | (api < Opcodes.ASM5 ? Opcodes.SOURCE_DEPRECATED : 0);

spring-core/src/main/java/org/springframework/asm/Opcodes.java

@@ -291,6 +291,7 @@ public interface Opcodes {
   int V24 = 0 << 16 | 68;
   int V25 = 0 << 16 | 69;
   int V26 = 0 << 16 | 70;
+  int V27 = 0 << 16 | 71;
 
   /**
    * Version flag indicating that the class is using 'preview' features.

spring-core/src/main/java/org/springframework/objenesis/package-info.java

@@ -1,6 +1,6 @@
 /**
  * Spring's repackaging of
- * <a href="http://objenesis.org">Objenesis 3.4</a>
+ * <a href="http://objenesis.org">Objenesis 3.5</a>
  * (with SpringObjenesis entry point; for internal use only).
  *
  * <p>This repackaging technique avoids any potential conflicts with