ParparVM: collector and codegen cleanup

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's

.github/workflows/ad-cn1lib-ios-native-check.yml

@@ -21,6 +21,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
  push:
  branches: [master]
@@ -29,6 +30,7 @@ on:
  - 'maven/cn1-applovin/**'
  - 'maven/cn1-unity-levelplay/**'
  - 'vm/ByteCodeTranslator/src/cn1_globals.h'
+ - 'vm/ByteCodeTranslator/src/cn1_virtual_thread.h'
  - '.github/workflows/ad-cn1lib-ios-native-check.yml'
 
 concurrency:
@@ -115,6 +117,11 @@ jobs:
  # cn1_globals.h for them. Reproduce that here, using the port's own
  # header so a change to those macros is caught too.
  cp vm/ByteCodeTranslator/src/cn1_globals.h "$PROBE/"
+ # cn1_globals.h includes this one (CN1_RESUME_THREAD yields a virtual
+ # thread rather than sleeping the carrier it runs on), so staging the
+ # first without the second stops the probe at "file not found" before it
+ # compiles a single line of the cn1lib.
+ cp vm/ByteCodeTranslator/src/cn1_virtual_thread.h "$PROBE/"
  # Generated per translation from the app's class list; nothing in the
  # ad bridges reads it, so an empty stand-in is enough to let
  # cn1_globals.h parse on its own.

CodenameOne/src/com/codename1/mapping/Mapper.java

@@ -48,6 +48,35 @@ public interface Mapper<T> {
  /// `JSONParser` and populates a fresh `T`.
  T fromMap(Map<String, Object> map);
 
+ /// Optional: append `instance` as JSON directly, without building a map
+ /// first.
+ ///
+ /// A generated mapper knows every property name and type at build time, so
+ /// it can append them in order rather than filling a `LinkedHashMap` -- with
+ /// a hash per key -- and having the writer walk it back rediscovering each
+ /// value's type. On a small object that map round trip is the majority of
+ /// the serialisation cost, not the escaping.
+ ///
+ /// Measured through `Mappers#toJson` on a four-property object, output
+ /// asserted identical: **2.05x / 1.51x / 2.81x** faster (263 -> 128,
+ /// 214 -> 142, 224 -> 80 ns per call).
+ ///
+ /// That measurement ran on Java SE, so the map it avoids is the JDK's
+ /// LinkedHashMap. On a translated device build the map is
+ /// `vm/JavaAPI`'s, which overrides the natives HashMap gets and costs about
+ /// 1.5x a HashMap to build -- so the saving there is at least this, not less.
+ ///
+ /// Implemented as a separate interface rather than a method on `Mapper` so
+ /// hand-written mappers keep compiling; `Mappers#toJson` uses it when the
+ /// mapper offers it and falls back to `toMap` when it does not.
+ interface Direct<T> {
+
+ /// Appends `instance` as a JSON value -- an object, or the four
+ /// characters `null`. Must produce exactly what
+ /// `JSONWriter.toJson(toMap(instance))` would.
+ void toJson(T instance, StringBuilder out);
+ }
+
  /// XML root element name (`@XmlRoot.value`, falling back to the class
  /// simple name with a lowercase first character).
  String xmlRootName();

CodenameOne/src/com/codename1/mapping/Mappers.java

@@ -109,8 +109,18 @@ public static String toJson(Object instance) {
  if (m == null) {
  throw missing(instance.getClass());
  }
- Map<String, Object> root = m.toMap(instance);
  StringBuilder sb = new StringBuilder();
+ if (m instanceof Mapper.Direct) {
+ // The generated mapper knows its properties at build time and can
+ // append them in order. Skips a LinkedHashMap, a hash per key and a
+ // walk back over it that rediscovers each value's type -- which on a
+ // small object is most of the cost of serialising it.
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, sb);
+ return sb.toString();
+ }
+ Map<String, Object> root = m.toMap(instance);
  writeJson(sb, root);
  return sb.toString();
  }
@@ -208,6 +218,112 @@ private static IllegalStateException missing(Class<?> type) {
  // Tiny JSON writer
  // ---------------------------------------------------------------
 
+ /// Appends any value a generated codec can hold, producing exactly what the
+ /// map path would.
+ ///
+ /// Public because generated `toJson` methods call it for the property kinds
+ /// they cannot render inline -- a nested mapped object, a `Property`'s value,
+ /// a list element. A nested object goes through ITS mapper, taking that
+ /// mapper's `Mapper.Direct` route when it offers one, so nesting stays free
+ /// of intermediate maps all the way down.
+ ///
+ /// Conversions match `Mapper#toMap` exactly, and must keep matching: a date
+ /// becomes its millisecond value and an enum its `name()`, because that is
+ /// what the map path puts in the map before the writer ever sees it.
+ public static void appendJsonValue(StringBuilder out, Object value) {
+ if (value == null) {
+ out.append("null");
+ return;
+ }
+ if (value instanceof java.util.Date) {
+ out.append(((java.util.Date) value).getTime());
+ return;
+ }
+ if (value instanceof String || value instanceof Boolean
+ || value instanceof Number || value instanceof Map
+ || value instanceof java.util.Collection) {
+ writeJson(out, value);
+ return;
+ }
+ // A mapped object, or something with no mapper at all -- appendJson
+ // decides, and falls back to the string form the map path would use.
+ appendJson(value, out);
+ }
+
+ /// Appends `instance` as a JSON object using its registered mapper, taking
+ /// the `Mapper.Direct` route when that mapper offers one.
+ ///
+ /// Unlike `#toJson(Object)` this appends rather than returning a String, so
+ /// nesting does not build one String per level. An unmapped value falls back
+ /// to its `toString`, which is what `Mapper#toMap` does for the same case
+ /// rather than failing the whole document.
+ public static void appendJson(Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) BY_NAME.get(instance.getClass().getName());
+ if (m == null) {
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (m instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) m;
+ d.toJson(instance, out);
+ return;
+ }
+ writeJson(out, m.toMap(instance));
+ }
+
+ /// Appends `value` exactly as `JSONWriter` would render it if it had been put
+ /// into the map that `Mapper#toMap` builds.
+ ///
+ /// This is deliberately NOT `#appendJsonValue`: that one is smarter, turning a
+ /// `Date` into epoch milliseconds and a mapped object into nested JSON. Where a
+ /// generated mapper is reproducing what the map path stored RAW -- a `Property`
+ /// value is the case that matters -- being smarter is being different, and
+ /// `Mapper.Direct` promises identical output rather than better output.
+ public static void appendJsonRaw(StringBuilder out, Object value) {
+ writeJson(out, value);
+ }
+
+ /// Appends `instance` through the mapper the CALLER names, rather than the one
+ /// registered for the instance's runtime class.
+ ///
+ /// The distinction is polymorphism. A field declared `Base` holding an instance
+ /// of an unmapped subclass finds no mapper by runtime class, and
+ /// `#appendJson(Object, StringBuilder)` then falls back to the quoted
+ /// `toString`. `Mapper#toMap` looks the mapper up by the DECLARED type and
+ /// serialises the subclass as an object, so a generated mapper reproducing the
+ /// map path has to ask the same question. Mirrors what the map path does with a
+ /// null mapper too: the raw value, which renders as its quoted `toString`.
+ public static void appendJsonUsing(Mapper<?> mapper, Object instance, StringBuilder out) {
+ if (instance == null) {
+ out.append("null");
+ return;
+ }
+ if (mapper == null) {
+ // toString(), not the raw value. emitFieldToMap stores `_v.toString()`
+ // when the declared type has no registered mapper, so JSONWriter quotes
+ // it -- an Object field holding an Integer comes out as "5". Passing the
+ // instance to writeJson would emit 5, changing the field's wire TYPE the
+ // day its mapper gains a direct writer.
+ writeJsonString(out, instance.toString());
+ return;
+ }
+ if (mapper instanceof Mapper.Direct) {
+ @SuppressWarnings("unchecked")
+ Mapper.Direct<Object> d = (Mapper.Direct<Object>) mapper;
+ d.toJson(instance, out);
+ return;
+ }
+ @SuppressWarnings("unchecked")
+ Mapper<Object> m = (Mapper<Object>) mapper;
+ writeJson(out, m.toMap(instance));
+ }
+
  static void writeJson(StringBuilder sb, Object value) {
  if (value == null) {
  sb.append("null");
@@ -249,6 +365,19 @@ static void writeJson(StringBuilder sb, Object value) {
  writeJsonString(sb, value.toString());
  }
 
+ /// Appends `s` as an escaped JSON string, or `null`.
+ ///
+ /// Public because GENERATED mappers call it: a direct writer has to escape
+ /// exactly the way the map path does, and the only way to guarantee that is
+ /// for both to use this method rather than each having its own copy.
+ public static void appendJsonString(StringBuilder sb, String s) {
+ if (s == null) {
+ sb.append("null");
+ return;
+ }
+ writeJsonString(sb, s);
+ }
+
  private static void writeJsonString(StringBuilder sb, String s) {
  sb.append('"');
  int len = s.length();

Ports/JavaSE/src/com/codename1/impl/javase/UnzipUtility.java

@@ -1,9 +1,32 @@
+/*
+ * Copyright (c) 2026, Codename One and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation. Codename One designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Codename One through http://www.codenameone.com/ if you
+ * need additional information or have any questions.
+ */
 package com.codename1.impl.javase;
 import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -23,42 +46,67 @@ public class UnzipUtility {
  public void unzip(String zipFilePath, String destDirectory) throws IOException {
  File destDir = new File(destDirectory);
  if (!destDir.exists()) {
- destDir.mkdir();
+ destDir.mkdirs();
  }
+ // Canonical, because that is what resolves the "../" an archive can carry.
+ Path destRoot = destDir.getCanonicalFile().toPath();
  ZipInputStream zipIn = new ZipInputStream(new FileInputStream(zipFilePath));
- ZipEntry entry = zipIn.getNextEntry();
- // iterates over entries in the zip file
- while (entry != null) {
- String filePath = destDirectory + File.separator + entry.getName();
- if (!entry.isDirectory()) {
- // if the entry is a file, extracts it
- extractFile(zipIn, filePath);
- } else {
- // if the entry is a directory, make the directory
- File dir = new File(filePath);
- dir.mkdir();
+ try {
+ ZipEntry entry = zipIn.getNextEntry();
+ // iterates over entries in the zip file
+ while (entry != null) {
+ // ZIP SLIP. An entry name is attacker-controlled and may be
+ // "../../something": concatenating it onto the destination writes
+ // wherever the archive says, which for these two callers means an
+ // arbitrary file overwritten under the user's account while they
+ // believe they are unpacking Groovy or JavaFX. Refuse anything that
+ // does not land inside the destination.
+ //
+ // Path.startsWith compares COMPONENT-wise, not character-wise, so
+ // "/tmp/dest-evil" is correctly rejected against "/tmp/dest" -- a
+ // plain String.startsWith accepts it unless the prefix is given a
+ // trailing separator, and then it wrongly rejects the destination
+ // itself. Neither trap exists here.
+ Path target = new File(destDir, entry.getName()).getCanonicalFile().toPath();
+ if (!target.startsWith(destRoot)) {
+ throw new IOException("Zip entry escapes the destination directory: "
+ + entry.getName());
+ }
+ File targetFile = target.toFile();
+ if (!entry.isDirectory()) {
+ // Nested entries can arrive before the directory that holds
+ // them, and FileOutputStream will not create it.
+ File parent = targetFile.getParentFile();
+ if (parent != null) {
+ parent.mkdirs();
+ }
+ extractFile(zipIn, targetFile);
+ } else {
+ targetFile.mkdirs();
+ }
+ zipIn.closeEntry();
+ entry = zipIn.getNextEntry();
  }
- zipIn.closeEntry();
-entry = zipIn.getNextEntry();
+} finally {
+ zipIn.close();
  }
- zipIn.close();
  }
  /**
  * Extracts a zip entry (file entry)
  * @param zipIn
- * @param filePath
+ * @param target
  * @throws IOException
  */
- private void extractFile(ZipInputStream zipIn, String filePath) throws IOException {
- BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(filePath));
- byte[] bytesIn = new byte[BUFFER_SIZE];
- int read = 0;
- while ((read = zipIn.read(bytesIn)) != -1) {
- bos.write(bytesIn, 0, read);
+ private void extractFile(ZipInputStream zipIn, File target) throws IOException {
+ BufferedOutputStream bos = new BufferedOutputStream(new FileOutputStream(target));
+ try {
+ byte[] bytesIn = new byte[BUFFER_SIZE];
+ int read = 0;
+ while ((read = zipIn.read(bytesIn)) != -1) {
+ bos.write(bytesIn, 0, read);
+ }
+ } finally {
+ bos.close();
  }
- bos.close();
  }
 }
-
-
-

Ports/LinuxPort/nativeSources/cn1_linux_socket.c

@@ -108,6 +108,7 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  CN1Socket* s = (CN1Socket*) (intptr_t) socket;
  char* data;
  ssize_t n;
+ int readErrno;
  if (!s || s->fd < 0 || buffer == JAVA_NULL || length <= 0) {
  return -1;
  }
@@ -119,14 +120,19 @@ JAVA_INT com_codename1_impl_linux_LinuxNative_socketRead___long_byte_1ARRAY_int_
  * syscall. Every other CN1 port's blocking I/O does the same. */
  CN1_YIELD_THREAD;
  n = read(s->fd, data + offset, (size_t) length);
+ /* Captured before CN1_RESUME_THREAD. The resume is a GC safepoint and can park
+ * this thread on a timed wait, which overwrites errno -- so lastError below
+ * reported the WAIT's outcome rather than the read's, handing Java a misleading
+ * error for a failure that had nothing to do with it. */
+ readErrno = errno;
  CN1_RESUME_THREAD;
  /* Keep the buffer array object reachable across the parked read: only `data` (an
  * interior pointer) is used, so the optimizer may drop `buffer` and the concurrent GC
  * -- scanning this parked thread -- can sweep it mid-read (a use-after-free; see the
  * Windows port where this manifested on the cn1ss WebSocket reader). Force liveness. */
  CN1_SOCKET_KEEP_ALIVE(buffer);
  if (n <= 0) {
- s->lastError = n < 0 ? errno : 0;
+ s->lastError = n < 0 ? readErrno : 0;
  if (n == 0) {
  s->connected = 0;
  }

maven/codenameone-maven-plugin/src/main/java/com/codename1/builders/WatchNativeBuilder.java

@@ -572,9 +572,18 @@ List<String> stageWatchTranslation(BuildRequest request, File tmpFile, File appS
  // Swift phase fixup, which globs <Main>-src/**/*.swift, would have swept the watch
  // copy into the PHONE target instead. It is excluded from that glob for the same
  // reason (see IPhoneBuilder's swift fixup).
+ // .S belongs here too, for the same reason .swift does. The virtual-thread
+ // runtime's context switch has to be assembly (glibc aborts a cross-stack
+ // longjmp under _FORTIFY_SOURCE and musl has no makecontext), and it is the
+ // first .S the translator emits -- so copying cn1_virtual_thread.c without
+ // cn1_virtual_thread_asm.S left the WATCH target compiling a caller whose
+ // callee did not exist: "_cn1VirtualThreadSwitch, referenced from
+ // _cn1VirtualThreadYield ... symbol(s) not found". The phone target linked
+ // fine, so only a watch-enabled build shows it.
  boolean source = name.endsWith(".m") || name.endsWith(".c")
  || name.endsWith(".swift") || name.endsWith(".mm")
- || name.endsWith(".cpp") || name.endsWith(".cc");
+ || name.endsWith(".cpp") || name.endsWith(".cc")
+ || name.endsWith(".S") || name.endsWith(".s");
  if (!source && !name.endsWith(".h")) {
  // Only the code. The watch bundle's plist, resources and project file are written
  // by this builder against the PHONE project -- taking the second translation's