[aurelien-coet-sonarsource]

---

Summary by Gitar

• New frontend session layer:
  • Added FrontendSession, FrontendBackend, and FrontendParser to own the ECJ parser lifecycle, replacing direct ASTParser use in JParserConfig
  • Added FrontendBatch, FrontendConfiguration, and EcjFrontendBackend for batch inputs and parser setup
• Deterministic resource ownership:
  • Added FrontendResources to run environment cleaners in order, attempt every cleanup, and preserve the primary failure
  • JavaFrontend and JavaAstScanner now release environments through try-with-resources
  • JSema caches its environment cleaner so repeated cleanup runs once
• Test scoping:
  • Added TestResourceScope with a @Scoped annotation to keep parser fixtures alive through assertions
  • Added SemanticFixture and migrated many semantic tests and JParserTestUtils helpers to use it
• Progress monitor:
  • ProgressMonitor now implements only Runnable, dropping its IProgressMonitor contract

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-7284

[aurelien-coet-sonarsource]

/pvf

[hashicorp-vault-sonar-prod]

📊 Performance Validation complete
🆕 0 new · 🗑️ 0 lost issues
View dashboard

Projects with unexpected PVF results:

• crate

[gitar-bot]

Code Review ✅ Approved 1 closed / 1 findings

🟡 Medium risk · Refactoring parser sessions and cleanup across Java analysis could release ECJ environments too early or disrupt semantic resolution during scanning.

Introduces frontend sessions and deterministic resource ownership for the ECJ parser lifecycle, with try-with-resources release of environments and a TestResourceScope to keep parser fixtures alive through semantic assertions. Resolved the static JUtilsTest.SEMA retention issue by keeping it in whichever class scope loads it. No open issues found.

✅ 1 closed

✅ Edge Case: Static JUtilsTest.SEMA is retained in whichever class scope loads it

📄 java-frontend/src/test/java/org/sonar/java/model/JUtilsTest.java:53-54 📄 java-frontend/src/test/java/org/sonar/java/model/JMethodSymbolTest.java:58 📄 java-checks-test-sources/test-classpath-reader/src/main/java/org/sonar/java/test/TestResourceScope.java:53-66
JUtilsTest.SEMA is a static field initialized with sema(test("")), and test parses through the scoped helper. That means the parser session behind it is passed to TestResourceScope.retain in whatever scope is on top of the stack when the JVM initializes JUtilsTest. JMethodSymbolTest statically imports JUtilsTest.firstClass. If JMethodSymbolTest runs first, its first call to firstClass initializes JUtilsTest, and the session behind SEMA lands in JMethodSymbolTest's class scope. That scope closes in afterAll, which runs the ECJ environment cleaner. When JUtilsTest later runs in the same fork, SEMA and OBJECT_TYPE still point at that closed session. The result depends on test order, which goes against this commit's goal of keeping sessions alive through semantic assertions.

Fix: make SEMA and OBJECT_TYPE instance fields, or build them in a scoped @BeforeAll. Also, JMethodSymbolTest should not reach into JUtilsTest statics; it could use a shared helper class with no static parse state.

Verification Rules 2/2 met PRs 2 inspected

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Broader impact PRs 2 inspected

Cross-PR 2 PRs inspected 0 open impacts

PR 6455: SONARJAVA-7287 Prepare the integration of PSI into the Java frontend Inspected
PR 6456: SONARJAVA-7288 Replace Eclipse JDT core with PSI in the Java frontend Inspected

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
2 Fixed issues
4 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
93.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube