Dependency conflicts on com.fasterxml.jackson.core:jackson-core:jar, leading to invoking unexpected methods

[HelloCoCooo]

Hi, there are multiple versions of com.fasterxml.jackson.core:jackson-core:jar in vertx-examples-3.6.0 (spring-examples/springboot-example module). As shown in the following dependency tree, according to Maven's dependency management strategy, only com.fasterxml.jackson.core:jackson-core:jar:2.4.6 can be loaded, and com.fasterxml.jackson.core:jackson-core:jar: 2.9.7 will be shadowed.

Your project references the method <com.fasterxml.jackson.core.json.JsonGeneratorImpl:enable(JsonGenerator$Feature)> via the following invocation path, which is included in the shadowed version com.fasterxml.jackson.core:jackson-core:jar: 2.9.7. However, this method is missing in the actual loaded version com.fasterxml.jackson.core:jackson-core:jar:2.4.6. Surprisingly, it will not cause NoSuchMethodError at rumtime.

<io.vertx.ext.web.handler.sockjs.impl.SockJSSession: void register(io.vertx.core.http.HttpServerRequest,io.vertx.ext.web.handler.sockjs.impl.TransportListener)> C:\Users\Flipped\.m2\repository\io\vertx\vertx-web\3.6.0\vertx-web-3.6.0.jar
<io.vertx.ext.web.handler.sockjs.impl.SockJSSession: void writePendingMessages()> C:\Users\Flipped\.m2\repository\io\vertx\vertx-web\3.6.0\vertx-web-3.6.0.jar
<io.vertx.ext.web.handler.sockjs.impl.JsonCodec: java.lang.String encode(java.lang.Object)> C:\Users\Flipped\.m2\repository\io\vertx\vertx-web\3.6.0\vertx-web-3.6.0.jar
<com.fasterxml.jackson.databind.ObjectMapper: java.lang.String writeValueAsString(java.lang.Object)> C:\Users\Flipped\.m2\repository\com\fasterxml\jackson\core\jackson-databind\2.4.6\jackson-databind-2.4.6.jar
<com.fasterxml.jackson.databind.ObjectMapper: void _configAndWriteValue(com.fasterxml.jackson.core.JsonGenerator,java.lang.Object)> C:\Users\Flipped\.m2\repository\com\fasterxml\jackson\core\jackson-databind\2.4.6\jackson-databind-2.4.6.jar
<com.fasterxml.jackson.core.json.JsonGeneratorImpl: com.fasterxml.jackson.core.JsonGenerator enable(com.fasterxml.jackson.core.JsonGenerator$Feature)>

By further analyzing, I found that the caller io.vertx.ext.web.handler.sockjs.impl.SockJSSession.register(HttpServerRequest, TransportListener) would invoke the method GeneratorBase.enable(JsonGenerator$Feature) defined in the superclass of com.fasterxml.jackson.core.json.JsonGeneratorImpl (JsonGeneratorImpl extends GeneratorBase) with the same signature of the expected callee, due to dynamic binding mechanism.

Although the actual invoked method belonging to GeneratorBase has the same method name, same parameter types and return type as the expected method defined in its subclass JsonGeneratorImpl, but it has different control flows and different behaviors. Maybe it is buggy behavior.

Solution:
Use the newer version com.fasterxml.jackson.core:jackson-core:jar: 2.9.7 to keep the version consistency.

Dependency tree-----

[INFO] org.springframework.boot:springboot-example:jar:1.2.4.RELEASE
[INFO] +- org.springframework.boot:spring-boot-starter:jar:1.2.4.RELEASE:compile
[INFO] | +- org.springframework.boot:spring-boot:jar:1.2.4.RELEASE:compile
[INFO] | | +- (org.springframework:spring-core:jar:4.1.6.RELEASE:compile - omitted for duplicate)
[INFO] | | - org.springframework:spring-context:jar:4.1.6.RELEASE:compile
[INFO] | | +- org.springframework:spring-aop:jar:4.1.6.RELEASE:compile
[INFO] | | | +- aopalliance:aopalliance:jar:1.0:compile
[INFO] | | | +- (org.springframework:spring-beans:jar:4.1.6.RELEASE:compile - omitted for duplicate)
[INFO] | | | - (org.springframework:spring-core:jar:4.1.6.RELEASE:compile - omitted for duplicate)
[INFO] | | +- org.springframework:spring-beans:jar:4.1.6.RELEASE:compile
[INFO] | | | - (org.springframework:spring-core:jar:4.1.6.RELEASE:compile - omitted for duplicate)
[INFO] | | +- (org.springframework:spring-core:jar:4.1.6.RELEASE:compile - omitted for duplicate)
[INFO] | | - org.springframework:spring-expression:jar:4.1.6.RELEASE:compile
[INFO] | | - (org.springframework:spring-core:jar:4.1.6.RELEASE:compile - omitted for duplicate)
[INFO] | +- org.springframework.boot:spring-boot-autoconfigure:jar:1.2.4.RELEASE:compile
[INFO] | | +- (org.springframework.boot:spring-boot:jar:1.2.4.RELEASE:compile - omitted for duplicate)
[INFO] | | - org.yaml:snakeyaml:jar:1.14:compile
[INFO] | +- org.springframework.boot:spring-boot-starter-logging:jar:1.2.4.RELEASE:compile
[INFO] | | +- org.slf4j:jcl-over-slf4j:jar:1.7.12:compile
[INFO] | | | - org.slf4j:slf4j-api:jar:1.7.12:compile
[INFO] | | +- org.slf4j:jul-to-slf4j:jar:1.7.12:compile
[INFO] | | | - (org.slf4j:slf4j-api:jar:1.7.12:compile - omitted for duplicate)
[INFO] | | +- org.slf4j:log4j-over-slf4j:jar:1.7.12:compile
[INFO] | | | - (org.slf4j:slf4j-api:jar:1.7.12:compile - omitted for duplicate)
[INFO] | | - ch.qos.logback:logback-classic:jar:1.1.3:compile
[INFO] | | +- ch.qos.logback:logback-core:jar:1.1.3:compile
[INFO] | | - (org.slf4j:slf4j-api:jar:1.7.12:compile - version managed from 1.7.7; omitted for duplicate)
[INFO] | +- org.springframework:spring-core:jar:4.1.6.RELEASE:compile
[INFO] | - (org.yaml:snakeyaml:jar:1.14:compile - scope updated from runtime; omitted for duplicate)
[INFO] +- io.vertx:vertx-core:jar:3.6.0:compile
[INFO] | +- io.netty:netty-common:jar:4.1.30.Final:compile
[INFO] | +- io.netty:netty-buffer:jar:4.1.30.Final:compile
[INFO] | | - (io.netty:netty-common:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- io.netty:netty-transport:jar:4.1.30.Final:compile
[INFO] | | +- (io.netty:netty-buffer:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | - (io.netty:netty-resolver:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- io.netty:netty-handler:jar:4.1.30.Final:compile
[INFO] | | +- (io.netty:netty-buffer:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | +- (io.netty:netty-transport:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | - io.netty:netty-codec:jar:4.1.30.Final:compile
[INFO] | | - (io.netty:netty-transport:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- io.netty:netty-handler-proxy:jar:4.1.30.Final:compile
[INFO] | | +- (io.netty:netty-transport:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | +- io.netty:netty-codec-socks:jar:4.1.30.Final:compile
[INFO] | | | - (io.netty:netty-codec:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | - (io.netty:netty-codec-http:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- io.netty:netty-codec-http:jar:4.1.30.Final:compile
[INFO] | | - (io.netty:netty-codec:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- io.netty:netty-codec-http2:jar:4.1.30.Final:compile
[INFO] | | +- (io.netty:netty-codec-http:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | - (io.netty:netty-handler:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- io.netty:netty-resolver:jar:4.1.30.Final:compile
[INFO] | | - (io.netty:netty-common:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- io.netty:netty-resolver-dns:jar:4.1.30.Final:compile
[INFO] | | +- (io.netty:netty-resolver:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | +- io.netty:netty-codec-dns:jar:4.1.30.Final:compile
[INFO] | | | - (io.netty:netty-codec:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | | - (io.netty:netty-transport:jar:4.1.30.Final:compile - omitted for duplicate)
[INFO] | +- com.fasterxml.jackson.core:jackson-core:jar:2.4.6:compile (version managed from 2.9.7)
[INFO] | - com.fasterxml.jackson.core:jackson-databind:jar:2.4.6:compile (version managed from 2.9.7)
[INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.4.6:compile (version managed from 2.4.0)
[INFO] | - (com.fasterxml.jackson.core:jackson-core:jar:2.4.6:compile - version managed from 2.9.7; omitted for duplicate)
[INFO] - io.vertx:vertx-web:jar:3.6.0:compile
[INFO] +- io.vertx:vertx-web-common:jar:3.6.0:compile
[INFO] | - (io.vertx:vertx-core:jar:3.6.0:compile - omitted for duplicate)
[INFO] +- io.vertx:vertx-auth-common:jar:3.6.0:compile
[INFO] | - (io.vertx:vertx-core:jar:3.6.0:compile - omitted for duplicate)
[INFO] +- io.vertx:vertx-bridge-common:jar:3.6.0:compile
[INFO] - (io.vertx:vertx-core:jar:3.6.0:compile - omitted for duplicate)

Thanks!
Best regards,
Coco

[HelloCoCooo]

The code snippet of <JsonGeneratorImpl.enable(JsonGenerator$Feature)> in verison 2.9.7 ----

com.fasterxml.jackson.core:jackson-core:jar:2.4.6 does not contain <JsonGeneratorImpl.enable(JsonGenerator$Feature)>.
The code snippet of GeneratorBase.enable(JsonGenerator$Feature) in version 2.4.6----

The method <JsonGeneratorImpl.enable(JsonGenerator$Feature)> included in newer verison 2.9.7 deals with more cases and adds more control branches, which changes the control flows and data flows. So referencing GeneratorBase.enable(JsonGenerator$Feature) in version 2.4.6 by
dynamic binding, may lead to inconsisitent semantic behaviors.

Thanks again.

[vietj]

yes please

…

On 1 Mar 2019, at 17:02, HelloCoCooo ***@***.***> wrote: May I pull a request to solve this problem? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#335 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AANxihfeR_rfabHyBGUXhw8vLOVqQ9gYks5vSU8VgaJpZM4bZR47>.

[vietj]

right it is actually a parent ancestor spring-boot-dependencies that set this version to 2.4.6