TagValueExpression eventually resolves wrong result for #{cc} in composite component.

[Selaron]

When com.sun.faces.component.search.SearchExpressionHandlerImpl.resolveClientId is triggered by a component insite a Composite Component B, traversiong the viewRoot through components including an other Composite Component A, #{cc} in componentA.xhtml resolves to Composite Component B implementor class.

This may result into a javax.el.PropertyNotFoundException:

javax.el.PropertyNotFoundException: /resources/myComponents/componentA.xhtml @21,34 value="#{cc.customers}": Property [customers] not found on type [com.my.component.ComponentB] at com.sun.faces.facelets.el.TagValueExpression.getValue(TagValueExpression.java:117) at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:200) at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:187) at javax.faces.component.UIData.getValue(UIData.java:766) at javax.faces.component.UIData.getDataModel(UIData.java:1880) at javax.faces.component.UIData.setRowIndexWithoutRowStatePreserved(UIData.java:503) at javax.faces.component.UIData.setRowIndex(UIData.java:492) at javax.faces.component.UIData.invokeOnComponent(UIData.java:1089) at javax.faces.component.UIComponent.invokeOnComponent(UIComponent.java:1544) at javax.faces.component.UIComponentBase.invokeOnComponent(UIComponentBase.java:734) at javax.faces.component.UIComponent.invokeOnComponent(UIComponent.java:1544) at javax.faces.component.UIComponentBase.invokeOnComponent(UIComponentBase.java:734) at javax.faces.component.UIComponent.invokeOnComponent(UIComponent.java:1544) at javax.faces.component.UIComponentBase.invokeOnComponent(UIComponentBase.java:734) at javax.faces.component.UIComponent.invokeOnComponent(UIComponent.java:1544) at javax.faces.component.UIComponentBase.invokeOnComponent(UIComponentBase.java:734) at com.sun.faces.component.search.SearchExpressionHandlerImpl.invokeOnComponent(SearchExpressionHandlerImpl.java:337) at javax.faces.component.search.SearchExpressionHandler.invokeOnComponent(SearchExpressionHandler.java:216) at com.sun.faces.component.search.SearchExpressionHandlerImpl.resolveClientId(SearchExpressionHandlerImpl.java:85) at com.sun.faces.renderkit.html_basic.LabelRenderer.encodeBegin(LabelRenderer.java:98)

Versions affected: Mojarra 2.3.0-m10 to 2.3.3 Environment: Apache Tomcat 8.5.23 + 9.0.4 Oracle JDK 8

[Selaron]

reproducer.zip

Reproducer web application.

1. Invoke using mvn clean package jetty:run
2. Navigate to http://localhost:8080/reproducer/welcome.jsf
3. Look at the exception and stack trace.