--patch-module javac flag not working when javac strategy is sandboxed

[ckilian867]

Description of the bug:

When trying to patch a file into jdk.unsupported, using the --patch-module javac options succeeds when run with flag --strategy=Javac=local but fails when run with flag --strategy=Javac=sandboxed.

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Created minimal reproduction: https://github.com/ckilian867/bazel-sandbox-patch-module

Which operating system are you running Bazel on?

PRETTY_NAME="Debian GNU/Linux 10 (buster)"  
NAME="Debian GNU/Linux"  
VERSION_ID="10" 
VERSION="10 (buster)"  
VERSION_CODENAME=buster  
ID=debian  
HOME_URL="https://www.debian.org/"  
SUPPORT_URL="https://www.debian.org/support"  BUG_REPORT_URL="https://bugs.debian.org/"

What is the output of bazel info release?

$ bazel info release INFO: Invocation ID: 24daef35-76ab-4f86-a488-83cc55328f87 release 5.1.0

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse master; git rev-parse HEAD ?

$ git remote get-url origin; git rev-parse master; git rev-parse HEAD
https://github.com/ckilian867/bazel-sandbox-patch-module.git
1fb9443f0c9910f8e21f5cdd504727a972d705f8
1fb9443f0c9910f8e21f5cdd504727a972d705f8

Have you found anything relevant by searching the web?

Nothing related to Bazel's use of --patch-module

Any other information, logs, or outputs that you want to share?

Error output in README of https://github.com/ckilian867/bazel-sandbox-patch-module

[ckilian867]

Hey all, any update on this?

[meisterT]

@larsrc-google @cushon any ideas?

[larsrc-google]

Thanks for the nice repro, @ckilian867. Here's an example failing run:

ERROR: /Users/larsrc/git/bazel-sandbox-patch-module/example/BUILD.bazel:1:13: Building example/libproblem.jar (1 source file) failed: (Exit 1): sandbox-exec failed: error executing command 
  (cd /private/var/tmp/_bazel_larsrc/96bd71f558a71106734190feb386ccd4/sandbox/darwin-sandbox/5/execroot/__main__ && \
  exec env - \
    LC_CTYPE=en_US.UTF-8 \
    PATH=/Users/larsrc/mdproxy/bin:/Users/larsrc/Downloads/google-cloud-sdk/bin:/usr/local/git/current/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin:/usr/local/go/bin:/Users/larsrc/bin \
    TMPDIR=/var/folders/z8/xxx1_95s31gf2h3cjcfv2264003p7w/T/ \
  /usr/bin/sandbox-exec -f /private/var/tmp/_bazel_larsrc/96bd71f558a71106734190feb386ccd4/sandbox/darwin-sandbox/5/sandbox.sb /var/tmp/_bazel_larsrc/install/d3bd16a8b22c859ba58f5dca04a9b1aa/process-wrapper '--timeout=0' '--kill_delay=15' external/remotejdk11_macos/bin/java -XX:+UseParallelOldGC -XX:-CompactStrings '--patch-module=java.compiler=external/remote_java_tools_darwin/java_tools/java_compiler.jar' '--patch-module=jdk.compiler=external/remote_java_tools_darwin/java_tools/jdk_compiler.jar' '--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED' '--add-exports=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED' '--add-exports=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED' '--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED' '--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED' '--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED' '--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED' '--add-opens=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED' '--add-opens=java.base/java.nio=ALL-UNNAMED' '--add-opens=java.base/java.lang=ALL-UNNAMED' -jar external/remote_java_tools_darwin/java_tools/JavaBuilder_deploy.jar @bazel-out/darwin-fastbuild/bin/example/libproblem.jar-0.params @bazel-out/darwin-fastbuild/bin/example/libproblem.jar-1.params)
example/Problem.java:1: error: package exists in another module: jdk.unsupported
package sun.misc;
^
Target //example:problem failed to build

The --javacopt values get passed in the $bazel-out/darwin-fastbuild/bin/example/libproblem.jar-0.params in my case, which contains

--output
bazel-out/darwin-fastbuild/bin/example/libproblem.jar
--native_header_output
bazel-out/darwin-fastbuild/bin/example/libproblem-native-header.jar
--output_manifest_proto
bazel-out/darwin-fastbuild/bin/example/libproblem.jar_manifest_proto
--compress_jar
--output_deps_proto
bazel-out/darwin-fastbuild/bin/example/libproblem.jdeps
--bootclasspath
bazel-out/darwin-fastbuild/bin/external/bazel_tools/tools/jdk/platformclasspath.jar
--sources
example/Problem.java
--javacopts
-source
8
-target
8
-XDskipDuplicateBridges=true
-XDcompilePolicy=simple
-g
-parameters
--patch-module=jdk.unsupported=example
--release
11
--
--target_label
//example:problem
--strict_java_deps
ERROR
--experimental_fix_deps_tool
add_dep

These files are the same for local and sandboxed execution. Passing this over to Liam for deeper Java knowledge.

[larsrc-google]

My most likely explanation is that the --patch-module flag makes Javac try to read something that's not there because it's not properly declared and thus not included in the sandbox. But your repro doesn't include any actual jar file to patch in, so I'm not sure why that would fail.