Proguard incorrectly backports default interface method parameter annotations

[Berstanio]

A simple setup reproduces the issue:

@Target({ElementType.METHOD, ElementType.PARAMETER})
@Retention(RetentionPolicy.RUNTIME)
public @interface RuntimeAnnotation {
}

public class ImplementingClass implements DefaultInterface {}

public interface DefaultInterface {
    default void something(@RuntimeAnnotation String par) {}
}

Processing this with these proguard flags:

-dontshrink
-dontobfuscate
-dontoptimize
-dontwarn
-dontnote

-target 7
-allowaccessmodification

Will result in the following desugared method:

  public void something(java.lang.String);
    descriptor: (Ljava/lang/String;)V
    flags: (0x0001) ACC_PUBLIC
    Code:
      stack=0, locals=2, args_size=2
         0: return
      LineNumberTable:
        line 8: 0
      LocalVariableTable:
        Start  Length  Slot  Name   Signature
            0       1     0  this   Lde/test/DefaultInterface;
            0       1     1   par   Ljava/lang/String;
    RuntimeVisibleParameterAnnotations:
}

Which is clearly incorrect. It not only omits the parameter annotations, but it also emits an invalid section that will result in a java.lang.annotation.AnnotationFormatError

[Berstanio]

fwiw, adding this patch to proguard core fixes it:

diff --git a/src/main/java/proguard/classfile/editor/AttributeAdder.java b/src/main/java/proguard/classfile/editor/AttributeAdder.java
--- a/src/main/java/proguard/classfile/editor/AttributeAdder.java	(revision c30881360ad88dcd21f391828d9933b6b6fa5071)
+++ b/src/main/java/proguard/classfile/editor/AttributeAdder.java	(date 1732721183375)
@@ -538,7 +538,7 @@
 
         RuntimeVisibleParameterAnnotationsAttribute newParameterAnnotationsAttribute =
             new RuntimeVisibleParameterAnnotationsAttribute(constantAdder.addConstant(clazz, runtimeVisibleParameterAnnotationsAttribute.u2attributeNameIndex),
-                                                            0,
+                                                            runtimeVisibleParameterAnnotationsAttribute.u1parametersCount,
                                                             new int[runtimeVisibleParameterAnnotationsAttribute.u1parametersCount],
                                                             parameterAnnotations);
 
@@ -565,7 +565,7 @@
 
         RuntimeInvisibleParameterAnnotationsAttribute newParameterAnnotationsAttribute =
             new RuntimeInvisibleParameterAnnotationsAttribute(constantAdder.addConstant(clazz, runtimeInvisibleParameterAnnotationsAttribute.u2attributeNameIndex),
-                                                              0,
+                                                              runtimeInvisibleParameterAnnotationsAttribute.u1parametersCount,
                                                               new int[runtimeInvisibleParameterAnnotationsAttribute.u1parametersCount],
                                                               parameterAnnotations);
 

[tvoc-gs]

Hello,

Thank you for getting in touch with us.

I am unfortunately unable to reproduce this issue with the current version of ProGuard (i.e. 7.6), with the example setup you gave.

In order to also help us review proguard-core #130, can you provide:

1. A ZIP of a sample project that includes the setup you showed in your opening comment.
2. The output of java -version on your machine.

[Berstanio]

Hi @tvoc-gs
here is a reproducer:
reproducer.zip
You just need to run check.sh with java 11, which will highlight the error on the bytecode level using javap and during runtime.
By accident I discovered another bug with backporting, while building the reproducer. Uncommenting the line 9 in ImplementingClass.java makes proguard crash.
My java version:

java -version
openjdk version "11.0.15" 2022-04-19
OpenJDK Runtime Environment GraalVM CE 22.1.0 (build 11.0.15+10-jvmci-22.1-b06)
OpenJDK 64-Bit Server VM GraalVM CE 22.1.0 (build 11.0.15+10-jvmci-22.1-b06, mixed mode)