Audit TODO comments in core/src/vm/classmgr/ older than 3 years

[LSantha]

I want a comprehensive audit of all TODO / FIXME / XXX comments in core/src/vm/classmgr/ that are older than 3 years (i.e. in code last touched before 2023).

For each, report:

• File and line number
• The full text of the comment
• The author of the last commit that touched the line (git blame -L <line>,<line> <file>)
• Whether the issue the TODO describes is still relevant (best guess)

Goal: I want to clean up the stale ones and prioritize the active ones.

[LSantha]

/oc Please proceed with this task.

[LSantha]

/oc Please proceed with this task.

[opencode-agent]

Audit: TODO/FIXME/XXX Comments in core/src/core/org/jnode/vm/classmgr/

Important caveat: The git repository has only a single initial commit (commit 6ab0668 by Levente Santha, 2026-06-06), so git blame dates do not reflect real history. Age analysis below is based on code context instead.

18 comments found across 8 files — all are TODO (no FIXME or XXX found).

---

1. VmType.java:1842 — // TODO implement verification

Field	Value
Author (blame)	Levente Santha
Full text	// TODO implement verification
Context	In doVerify() — only checks superclass and toggles flags; no bytecode verification is performed
Relevance	Active. JNode's verifier body was never written. The method just marks the class as verified without actual checking.

---

2. VmType.java:2495-2497 — security check commented out

Field	Value
Author (blame)	Levente Santha
Full text	Line 2495: //todo: misplaced securty check -> stack overflow in gnu.testlet.
	Line 2496: //todo: TestSecurityManager.checkPermission
	Line 2497: //todo secure this method
Context	getVmClass() — the SecurityManager.checkPermission call is commented out due to a stack overflow
Relevance	Active (underlying issue). Code is dead (commented out), but the root problem (stack overflow in security check, missing security infrastructure) remains unresolved.

---

3. VmStaticsIterator.java:53 — //todo fix this

Field	Value
Author (blame)	Levente Santha
Full text	//todo fix this
Context	Catches NullPointerException from statics.getTypeEntry(current) when a VmType object gets GC'd. Silently swallows the NPE.
Relevance	Active. The iterator silently skips entries instead of properly handling the GC race condition.

---

4. VmMember.java:72 — //todo review interning, this might not be needed here

Field	Value
Author (blame)	Levente Santha
Full text	this.name = InternString.internString(name); //todo review interning, this might not be needed here
Context	Constructor interning the member name string.
Relevance	Low priority. Minor performance concern. Interning may be redundant since class loading already deduplicates.

---

5. VmMethod.java:162 — //todo security review

Field	Value
Author (blame)	Levente Santha
Full text	//todo security review
Context	Above getBytecode() method
Relevance	Active (low urgency). No security model exists; this is a marker for a post-security-audit review.

---

6. VmMethod.java:273 — //todo security review

Field	Value
Author (blame)	Levente Santha
Full text	//todo security review
Context	Above resetOptLevel() — clears optimization level, could be abused
Relevance	Active (low urgency). Same as above. Pairs with the getBytecode() security review marker.

---

7. VmConstantPool.java:100 — //todo implement it

Field	Value
Author (blame)	Levente Santha
Full text	//todo implement it
Context	getMemberRefInfoAt(int index) — throws UnsupportedOperationException()
Relevance	Active. Required by sun.reflect.ConstantPool superclass. Needed for full reflection support.

---

8. VmConstantPool.java:108 — //todo implement it

Field	Value
Author (blame)	Levente Santha
Full text	//todo implement it
Context	getMethodAt(int index) — throws UnsupportedOperationException()
Relevance	Active. Same as above — unimplemented constant pool accessor.

---

9. VmConstantPool.java:114 — //todo implement it

Field	Value
Author (blame)	Levente Santha
Full text	//todo implement it
Context	getMethodAtIfLoaded(int index) — throws UnsupportedOperationException()
Relevance	Active. Same as above.

---

10. VmAnnotation.java:101 — //todo will be obsolate when annotation paring is migrated to openjdk

Field	Value
Author (blame)	Levente Santha
Full text	//todo will be obsolate when annotation paring is migrated to openjdk
Context	In getValue() — checks for @AllowedPackages and does custom annotation value construction
Relevance	Stale/blocked. Migration to OpenJDK annotation parsing is still incomplete; custom path remains in use.

---

11. VmAnnotation.java:233 — // TODO fix me

Field	Value
Author (blame)	Levente Santha
Full text	final int maxStack = 3; // TODO fix me
Context	Synthetic annotation proxy method — maxStack is hardcoded to 3
Relevance	Active. Fragile assumption; a complex annotation with deeply nested values could exceed this limit.

---

12. ClassDecoder.java:955 — //todo will get obsolate with openjdk based annotation support

Field	Value
Author (blame)	Levente Santha
Full text	//todo will get obsolate with openjdk based annotation support
Context	RuntimeVisibleAnnotations handler — calls both setRawAnnotations() and readRuntimeAnnotations2()
Relevance	Active. Code executes both raw (OpenJDK-path) and custom annotation parsing. The raw path suggests the migration is partially in progress.

---

13. ClassDecoder.java:966 — //todo will get obsolate with openjdk based annotation support

Field	Value
Author (blame)	Levente Santha
Full text	//todo will get obsolate with openjdk based annotation support
Context	RuntimeVisibleParameterAnnotations handler — same dual-path pattern
Relevance	Active. Same situation as #12.

---

14. ClassDecoder.java:971 — //todo will get obsolate with openjdk based annotation support

Field	Value
Author (blame)	Levente Santha
Full text	//todo will get obsolate with openjdk based annotation support
Context	AnnotationDefault handler — stores raw bytes AND parses with custom code
Relevance	Active. Same situation.

---

15. ClassDecoder.java:1188 — //todo will get obsolate with openjdk based annotation support

Field	Value
Author (blame)	Levente Santha
Full text	//todo will get obsolate with openjdk based annotation support
Context	Comment above readAnnotation() helper method
Relevance	Active. This entire custom annotation parsing path is redundant once OpenJDK's sun.reflect.annotation.AnnotationParser is fully adopted.

---

16. TIBBuilder.java:106 — //todo review rules for overriding and do more testing

Field	Value
Author (blame)	Levente Santha
Full text	//todo review rules for overriding and do more testing
Context	Above overrides() method — checks public/protected/package-private visibility rules
Relevance	Active. The overrides() logic handles basic visibility but doesn't consider bridge methods or access flags comprehensively.

---

Summary

All 16 TODO markers are still active/relevant — none can be confidently removed without code changes.

Priority groupings:

Priority	Count	TODOs
High	5	VmType.java:1842 (missing verifier), VmConstantPool.java:100,108,114 (3 unimplemented methods), VmAnnotation.java:233 (fragile stack)
Medium	8	ClassDecoder.java:955,966,971,1188 (4x OpenJDK migration), VmAnnotation.java:101 (OpenJDK migration), VmStaticsIterator.java:53 (silent NPE), VmType.java:2495-2497 (dead security code), TIBBuilder.java:106 (override rules)
Low	3	VmMethod.java:162,273 (2x security review markers), VmMember.java:72 (interning review)

opencode session  |  github run

[LSantha]

/oc Please proceed with this task.

[opencode-agent]

The previous agent's audit is verified accurate. I've confirmed all 16 TODO markers at the exact line numbers reported across 8 files. No FIXME or XXX comments exist.

Verification results:

• All // TODO (2 instances) and //todo (14 instances) match the reported locations
• No stale TODOs found — all are still active/relevant given the code's current state
• git blame confirms all lines authored by Levente Santha (single initial commit 6ab0668)

Actionable next steps for clean-up:

Action	Items
Remove (resolved)	None — all 16 are still active
File issues for High priority	Missing verifier (VmType.java:1842), 3 unimplemented ConstantPool methods (VmConstantPool.java:100,108,114), fragile stack in annotation proxy (VmAnnotation.java:233)
Migrate to OpenJDK	ClassDecoder.java:955,966,971,1188 + VmAnnotation.java:101 — once annotation parsing is migrated, 5 TODOs vanish
Fix NPE handling	VmStaticsIterator.java:53 — replace silent catch with proper GC-safe iteration

The full report is already posted in the issue comment.

opencode session  |  github run

[LSantha]

/oc investigate

[LSantha]

🤖 Investigation Report

Question: Audit all TODO/FIXME/XXX comments in core/src/vm/classmgr/ older than 3 years and report whether each is still relevant.

Path note: core/src/vm/classmgr/ does not exist. The correct path is core/src/core/org/jnode/vm/classmgr/. The previous two agent runs audited it correctly.

Findings: 18 TODO markers across 8 files. No FIXME or XXX comments found. Git blame (single commit 398e1cb by Levente Santha, 2026-06-07) does not provide meaningful age — all lines were created in the initial import. Age assessment is based on code context.

#	File:Line	Full text	Relevance
1	VmType.java:1842	// TODO implement verification	High — active. doVerify() sets flags but performs no bytecode verification
2-4	VmType.java:2495-2497	//todo: misplaced securty check -> stack overflow ... secure this method	Medium — active. SecurityManager call commented out due to stack overflow; dead code
5	VmStaticsIterator.java:53	//todo fix this	Medium — active. Silently catches NPE from GC race on VmType; should use proper GC-safe iteration
6	VmMember.java:72	//todo review interning, this might not be needed here	Low — minor perf concern. Class loading already deduplicates names
7	VmMethod.java:162	//todo security review (above getBytecode())	Low — placeholder. No security model exists yet
8	VmMethod.java:273	//todo security review (above resetOptLevel())	Low — placeholder. Same as #7
9	VmAnnotation.java:101	//todo will be obsolate when annotation paring is migrated to openjdk	Medium — active. Custom annotation path remains in use; OpenJDK migration incomplete
10	VmAnnotation.java:233	final int maxStack = 3; // TODO fix me	High — active. Hardcoded maxStack could overflow on complex annotations
11	ClassDecoder.java:955	//todo will get obsolate with openjdk based annotation support	Medium — active. Dual-path parsing (custom + raw); migration partial
12	ClassDecoder.java:966	//todo will get obsolate with openjdk based annotation support	Medium — active. Same pattern for parameter annotations
13	ClassDecoder.java:971	//todo will get obsolate with openjdk based annotation support	Medium — active. Same pattern for AnnotationDefault
14	ClassDecoder.java:1188	//todo will get obsolate with openjdk based annotation support	Medium — active. Custom readAnnotation() is the fallback
15	TIBBuilder.java:106	//todo review rules for overriding and do more testing	Medium — active. overrides() lacks bridge method / access flag handling
16-18	VmConstantPool.java:100,108,114	//todo implement it (3 methods)	High — active. All throw UnsupportedOperationException; needed for reflection

Root cause: The repository has no granular commit history — all TODOs are from the initial code import. None can be confidently removed without code changes.

Suggested fix:

• High priority (5): Implement bytecode verification (VmType.java:1842), implement 3 ConstantPool methods (VmConstantPool.java:100,108,114), fix hardcoded maxStack (VmAnnotation.java:233)
• Medium priority (8): Fix NPE in VmStaticsIterator.java:53, address dead security code in VmType.java:2495-2497, complete OpenJDK annotation migration (ClassDecoder.java + VmAnnotation.java:101), review TIB overrides logic (TIBBuilder.java:106)
• Low priority (3): Security review markers (VmMethod.java:162,273) and interning review (VmMember.java:72)
• Remove TODO comments as the code issues are fixed

Confidence: high

References: core/src/core/org/jnode/vm/classmgr/ · 8 files: VmType.java, VmStaticsIterator.java, VmMember.java, VmMethod.java, VmAnnotation.java, ClassDecoder.java, TIBBuilder.java, VmConstantPool.java

[opencode-agent]

Investigation complete. 18 TODO markers found across 8 files in core/src/core/org/jnode/vm/classmgr/ (note: core/src/vm/classmgr/ does not exist — that's the correct expanded path). No FIXME/XXX comments exist.

All 18 are still active/relevant. Git blame shows a single initial commit (398e1cb, 2026-06-07) — no age differentiation from history.

Report posted to issue #477: #477 (comment)

Priority summary:

• High (5): Bytecode verifier (VmType.java:1842), 3 unimplemented ConstantPool methods, hardcoded maxStack (VmAnnotation.java:233)
• Medium (8): NPE in VmStaticsIterator.java:53, dead security code (VmType.java:2495-2497), 5 OpenJDK annotation migration markers, TIBBuilder.java:106 overrides
• Low (3): Security review placeholders + interning review

opencode session  |  github run