Index: lucene/analysis/build.xml
===================================================================
--- lucene/analysis/build.xml	(revision 1540497)
+++ lucene/analysis/build.xml	(working copy)
@@ -147,4 +147,8 @@
     <forall-analyzers target="-append-module-dependencies-properties"/>
   </target>
 	
+  <target name="check-forbidden-apis">
+    <forall-analyzers target="check-forbidden-apis"/>
+  </target>
+
 </project>
Index: lucene/analysis/stempel/build.xml
===================================================================
--- lucene/analysis/stempel/build.xml	(revision 1540497)
+++ lucene/analysis/stempel/build.xml	(working copy)
@@ -23,6 +23,11 @@
     Analyzer for indexing Polish
   </description>
 	
+  <property name="forbidden-sysout-excludes" value="
+    org/egothor/stemmer/Compile.class
+    org/egothor/stemmer/DiffIt.class
+  "/>
+
   <import file="../analysis-module-build.xml"/>
 
   <path id="classpath">
Index: lucene/benchmark/build.xml
===================================================================
--- lucene/benchmark/build.xml	(revision 1540497)
+++ lucene/benchmark/build.xml	(working copy)
@@ -26,6 +26,9 @@
     <import file="../module-build.xml"/>
     <property name="working.dir" location="work"/>
 
+    <!-- benchmark creates lots of sysout stuff, so dont run forbidden! -->
+    <target name="-check-forbidden-sysout"/>
+
     <target name="check-files">
         <available file="temp/news20.tar.gz" property="news20.exists"/>
 
Index: lucene/build.xml
===================================================================
--- lucene/build.xml	(revision 1540497)
+++ lucene/build.xml	(working copy)
@@ -174,66 +174,17 @@
     <lib-versions-check-macro dir="${common.dir}/.." centralized.versions.file="${common.dir}/ivy-versions.properties"/>
   </target>
 
-  <target name="check-forbidden-apis" depends="compile-tools,compile-test,install-forbidden-apis,-forbidden-apis-classpath,-check-forbidden-jdk-apis,-check-forbidden-test-apis,-check-system-out" description="Check forbidden API calls in compiled class files"/>
-
-  <!-- TODO: Make the forbidden API checks per module! -->
-  <target name="-forbidden-apis-classpath">
-    <path id="forbidden-apis.classpath">
-      <fileset dir="${basedir}" includes="**/lib/*.jar"/>
-      <dirset dir="${basedir}/build" includes="**/classes/*"/>
-    </path>
+  <!-- -install-forbidden-apis is *not* a useless dependency. do not remove -->
+  <target name="check-forbidden-apis" depends="-install-forbidden-apis" description="Check forbidden API calls in compiled class files">
+    <subant target="check-forbidden-apis" failonerror="true" inheritall="false">
+      <propertyset refid="uptodate.and.compiled.properties"/>
+      <fileset dir="core" includes="build.xml"/>
+      <fileset dir="test-framework" includes="build.xml"/>
+      <fileset dir="tools" includes="build.xml"/>
+    </subant>
+    <modules-crawl target="check-forbidden-apis"/>
   </target>
 
-  <target name="-check-forbidden-jdk-apis">
-    <forbidden-apis internalRuntimeForbidden="true" classpathref="forbidden-apis.classpath">
-      <bundledSignatures name="jdk-unsafe-${javac.target}"/>
-      <bundledSignatures name="jdk-deprecated-${javac.target}"/>
-      <signaturesFileSet dir="${common.dir}/tools/forbiddenApis">
-        <include name="base.txt" />
-      </signaturesFileSet>
-      <fileset dir="${basedir}/build" includes="**/*.class" />
-    </forbidden-apis>
-  </target>
-
-  <target name="-check-forbidden-test-apis">
-    <forbidden-apis signaturesFile="${common.dir}/tools/forbiddenApis/tests.txt" classpathref="forbidden-apis.classpath"> 
-      <classpath refid="junit-path"/>
-      <fileset dir="${basedir}/build" includes="**/classes/test/**/*.class,test-framework/**/*.class" />
-    </forbidden-apis>
-  </target>
-
-  <target name="-check-system-out">
-    <forbidden-apis bundledSignatures="jdk-system-out" classpathref="forbidden-apis.classpath">
-      <fileset dir="${basedir}/build">
-        <include name="**/classes/java/**/*.class"/>
-        <!-- this is basically tests -->
-        <exclude name="test-framework/**"/>
-        <!-- exclude command line tools -->
-        <exclude name="core/classes/java/org/apache/lucene/index/CheckIndex.class"/>
-        <exclude name="core/classes/java/org/apache/lucene/index/IndexUpgrader.class"/>
-        <exclude name="core/classes/java/org/apache/lucene/store/LockVerifyServer.class"/>
-        <exclude name="core/classes/java/org/apache/lucene/store/LockStressTest.class"/>
-        <exclude name="analysis/stempel/classes/java/org/egothor/stemmer/Compile.class"/>
-        <exclude name="analysis/stempel/classes/java/org/egothor/stemmer/DiffIt.class"/>
-        <exclude name="benchmark/**"/>
-        <exclude name="demo/classes/java/org/apache/lucene/**"/>
-        <exclude name="misc/classes/java/org/apache/lucene/index/CompoundFileExtractor.class"/>
-        <exclude name="misc/classes/java/org/apache/lucene/index/IndexSplitter.class"/>
-        <exclude name="misc/classes/java/org/apache/lucene/index/MultiPassIndexSplitter.class"/>
-        <exclude name="misc/classes/java/org/apache/lucene/misc/GetTermInfo.class"/>
-        <exclude name="misc/classes/java/org/apache/lucene/misc/HighFreqTerms.class"/>
-        <exclude name="misc/classes/java/org/apache/lucene/misc/IndexMergeTool.class"/>
-        <!-- not printing, just checking if its a system stream -->
-        <exclude name="core/classes/java/org/apache/lucene/util/PrintStreamInfoStream.class"/>
-        <!-- not printing, just generated code from javacc -->
-        <exclude name="queryparser/classes/java/org/apache/lucene/queryparser/classic/QueryParserTokenManager.class"/>
-        <exclude name="queryparser/classes/java/org/apache/lucene/queryparser/flexible/standard/parser/StandardSyntaxParserTokenManager.class"/>
-        <exclude name="queryparser/classes/java/org/apache/lucene/queryparser/surround/parser/QueryParserTokenManager.class"/>
-        <exclude name="facet/classes/java/org/apache/lucene/facet/util/PrintTaxonomyStats.class"/>
-      </fileset>
-    </forbidden-apis>
-  </target>
-
   <target name="resolve">
     <sequential>
       <ant dir="test-framework" target="resolve" inheritall="false">
Index: lucene/CHANGES.txt
===================================================================
--- lucene/CHANGES.txt	(revision 1540497)
+++ lucene/CHANGES.txt	(working copy)
@@ -286,6 +286,10 @@
 * LUCENE-5322: Clean up / simplify Maven-related Ant targets.
   (Steve Rowe)
 
+* LUCENE-4753: Run forbidden-apis Ant task per module. This allows more
+  improvements and prevents OOMs after the number of class files
+  raised recently.  (Uwe Schindler)
+
 Tests
 
 * LUCENE-5278: Fix MockTokenizer to work better with more regular expression
Index: lucene/common-build.xml
===================================================================
--- lucene/common-build.xml	(revision 1540497)
+++ lucene/common-build.xml	(working copy)
@@ -2176,13 +2176,52 @@
   </target>
   
   <!-- Forbidden API Task -->
-  <target name="install-forbidden-apis" unless="forbidden-apis.loaded" depends="ivy-availability-check,ivy-configure">
+  <property name="forbidden-base-excludes" value=""/>
+  <property name="forbidden-tests-excludes" value=""/>
+  <property name="forbidden-sysout-excludes" value=""/>
+  
+  <target name="-install-forbidden-apis" unless="forbidden-apis.loaded" depends="ivy-availability-check,ivy-configure">
     <ivy:cachepath organisation="de.thetaphi" module="forbiddenapis" revision="1.3"
       inline="true" conf="default" transitive="true" pathid="forbidden-apis.classpath"/>
     <taskdef name="forbidden-apis" classname="de.thetaphi.forbiddenapis.AntTask" classpathref="forbidden-apis.classpath"/>
     <property name="forbidden-apis.loaded" value="true"/>
+  </target>  
+
+  <target name="-init-forbidden-apis" depends="-install-forbidden-apis">
+    <path id="forbidden-apis.allclasses.classpath">
+      <path refid="classpath"/>
+      <path refid="test.classpath"/>
+      <path refid="junit-path"/>
+      <!-- include the output directories, too (so we can still resolve excluded classes: -->
+      <pathelement path="${build.dir}/classes/java"/>
+      <pathelement path="${build.dir}/classes/test"/>
+    </path>
+  </target>  
+
+  <target name="check-forbidden-apis" depends="-check-forbidden-base,-check-forbidden-tests,-check-forbidden-sysout" description="Check forbidden API calls in compiled class files"/>
+  
+  <target name="-check-forbidden-base" depends="-init-forbidden-apis,compile-core,compile-test">
+    <forbidden-apis internalRuntimeForbidden="true" classpathref="forbidden-apis.allclasses.classpath">
+      <bundledSignatures name="jdk-unsafe-${javac.target}"/>
+      <bundledSignatures name="jdk-deprecated-${javac.target}"/>
+      <signaturesFileSet file="${common.dir}/tools/forbiddenApis/base.txt"/>
+      <fileset dir="${build.dir}/classes/java" excludes="${forbidden-base-excludes}"/>
+      <fileset dir="${build.dir}/classes/test" excludes="${forbidden-tests-excludes}" erroronmissingdir="false"/>
+    </forbidden-apis>
   </target>
   
+  <target name="-check-forbidden-tests" depends="-init-forbidden-apis,compile-test">
+    <forbidden-apis signaturesFile="${common.dir}/tools/forbiddenApis/tests.txt" classpathref="forbidden-apis.allclasses.classpath"> 
+      <fileset dir="${build.dir}/classes/test" excludes="${forbidden-tests-excludes}"/>
+    </forbidden-apis>
+  </target>
+    
+  <target name="-check-forbidden-sysout" depends="-init-forbidden-apis,compile-core">
+    <forbidden-apis bundledSignatures="jdk-system-out" classpathref="forbidden-apis.allclasses.classpath">
+      <fileset dir="${build.dir}/classes/java" excludes="${forbidden-sysout-excludes}"/>
+    </forbidden-apis>
+  </target>
+
   <!-- PEGDOWN macro: Before using depend on the target "resolve-pegdown,resolve-groovy" -->
   
   <target name="resolve-pegdown" unless="pegdown.loaded" depends="ivy-availability-check,ivy-configure">
Index: lucene/core/build.xml
===================================================================
--- lucene/core/build.xml	(revision 1540497)
+++ lucene/core/build.xml	(working copy)
@@ -22,6 +22,14 @@
 
   <property name="build.dir" location="../build/core"/>
 
+  <property name="forbidden-sysout-excludes" value="
+    org/apache/lucene/index/CheckIndex.class
+    org/apache/lucene/index/IndexUpgrader.class
+    org/apache/lucene/store/LockVerifyServer.class
+    org/apache/lucene/store/LockStressTest.class
+    org/apache/lucene/util/PrintStreamInfoStream.class
+  "/>
+
   <import file="../common-build.xml"/>
 
   <property name="moman.commit-hash" value="5c5c2a1e4dea" />
Index: lucene/demo/build.xml
===================================================================
--- lucene/demo/build.xml	(revision 1540497)
+++ lucene/demo/build.xml	(working copy)
@@ -53,6 +53,9 @@
     </invoke-module-javadoc>
   </target>
 
+  <!-- we don't check for sysout in demo, because the demo is there to use sysout :-) -->
+  <target name="-check-forbidden-sysout"/>
+
   <target name="compile-core" depends="jar-analyzers-common,jar-queryparser,jar-queries,jar-facet,jar-expressions,common.compile-core" />
 
   <target name="default" depends="jar-core,build-web-demo"/>
Index: lucene/facet/build.xml
===================================================================
--- lucene/facet/build.xml	(revision 1540497)
+++ lucene/facet/build.xml	(working copy)
@@ -23,6 +23,10 @@
     Faceted indexing and search capabilities
   </description>
 
+  <property name="forbidden-sysout-excludes" value="
+    org/apache/lucene/facet/util/PrintTaxonomyStats.class
+  "/>
+
   <import file="../module-build.xml"/>
 
   <path id="classpath">
Index: lucene/misc/build.xml
===================================================================
--- lucene/misc/build.xml	(revision 1540497)
+++ lucene/misc/build.xml	(working copy)
@@ -23,6 +23,15 @@
     Index tools and other miscellaneous code
   </description>
 
+  <property name="forbidden-sysout-excludes" value="
+    org/apache/lucene/index/CompoundFileExtractor.class
+    org/apache/lucene/index/IndexSplitter.class
+    org/apache/lucene/index/MultiPassIndexSplitter.class
+    org/apache/lucene/misc/GetTermInfo.class
+    org/apache/lucene/misc/HighFreqTerms.class
+    org/apache/lucene/misc/IndexMergeTool.class
+  "/>
+
   <import file="../module-build.xml"/>
 
   <target name="install-cpptasks" unless="cpptasks.uptodate" depends="ivy-availability-check,ivy-fail,ivy-configure">
Index: lucene/queryparser/build.xml
===================================================================
--- lucene/queryparser/build.xml	(revision 1540497)
+++ lucene/queryparser/build.xml	(working copy)
@@ -20,6 +20,11 @@
     Query parsers and parsing framework
   </description>
 
+  <!-- TODO: remove the stupid debugStream in the JavaCC TokenManager classes with an additional regex below! -->
+  <property name="forbidden-sysout-excludes" value="
+    org/apache/lucene/queryparser/**/*TokenManager.class
+  "/>
+
   <import file="../module-build.xml"/>
 
   <path id="classpath">
Index: lucene/test-framework/build.xml
===================================================================
--- lucene/test-framework/build.xml	(revision 1540497)
+++ lucene/test-framework/build.xml	(working copy)
@@ -42,6 +42,17 @@
   <!-- redefine the clover setup, because we dont want to run clover for the test-framework -->
   <target name="-clover.setup" if="run.clover"/>
 
+  <!-- redefine the test compilation, so its just a no-op -->
+  <target name="compile-test"/>
+  
+  <!-- redefine the forbidden apis for tests, as we check ourselves - no sysout testing -->
+  <target name="-check-forbidden-tests" depends="-init-forbidden-apis,compile-core">
+    <forbidden-apis signaturesFile="${common.dir}/tools/forbiddenApis/tests.txt" classpathref="forbidden-apis.allclasses.classpath"> 
+      <fileset dir="${build.dir}/classes/java"/>
+    </forbidden-apis>
+  </target>
+  <target name="-check-forbidden-sysout"/>
+
   <target name="javadocs-core" depends="javadocs"/>
   <target name="javadocs" depends="init,javadocs-lucene-core,javadocs-lucene-codecs">
     <sequential>
Index: lucene/tools/build.xml
===================================================================
--- lucene/tools/build.xml	(revision 1540497)
+++ lucene/tools/build.xml	(working copy)
@@ -27,8 +27,19 @@
   <import file="../common-build.xml"/>
 
   <path id="classpath">
+    <!-- TODO: we need this for forbidden-apis to be happy, because it does not support "includeantruntime": -->
+    <path refid="ant-path"/>
   </path>
 
+  <path id="test.classpath"/>
+
+  <!-- redefine the test compilation, so its just a no-op -->
+  <target name="compile-test"/>
+  
+  <!-- redefine the forbidden apis to be no-ops -->
+  <target name="-check-forbidden-tests"/>
+  <target name="-check-forbidden-sysout"/>
+
   <!--  
       Specialize compile-core to not depend on clover, to exclude a 
       classpath reference when compiling, and to not attempt to copy
Index: solr/build.xml
===================================================================
--- solr/build.xml	(revision 1540497)
+++ solr/build.xml	(working copy)
@@ -267,51 +267,16 @@
     </license-check-macro>
   </target>
   
-  <target name="check-forbidden-apis" depends="compile-tools,compile-test,install-forbidden-apis,-forbidden-apis-classpath,-check-forbidden-java-apis,-check-forbidden-test-apis" 
-          description="Check forbidden API calls in compiled class files."/>
-
-  <!-- TODO: Make the forbidden API checks per module! Also remove failOnMissingClasses="false" below!!! -->
-  <target name="-forbidden-apis-classpath">
-    <path id="forbidden-apis.classpath">
-      <fileset dir="${basedir}" includes="**/lib/*.jar,**/test-lib/*.jar"/>
-      <dirset dir="${basedir}/build" includes="**/classes/*"/>
-      <path refid="solr.lucene.libs"/>
-      <path refid="classpath"/>
-      <path refid="test.classpath"/>
-    </path>
+  <target name="check-forbidden-apis" depends="-install-forbidden-apis" description="Check forbidden API calls in compiled class files.">
+    <subant target="check-forbidden-apis" inheritall="false" >
+      <propertyset refid="uptodate.and.compiled.properties"/>
+      <fileset dir="core" includes="build.xml"/>
+      <fileset dir="solrj" includes="build.xml"/>
+      <fileset dir="test-framework" includes="build.xml"/>
+    </subant>
+    <contrib-crawl target="check-forbidden-apis" failonerror="true"/>
   </target>
 
-  <target name="-check-forbidden-java-apis">
-    <property file="${common.dir}/ivy-versions.properties"/> <!-- for commons-io version -->
-    <forbidden-apis internalRuntimeForbidden="true" classpathref="forbidden-apis.classpath" failOnMissingClasses="false">
-      <bundledSignatures name="jdk-unsafe-${javac.target}"/>
-      <bundledSignatures name="jdk-deprecated-${javac.target}"/>
-      <bundledSignatures name="commons-io-unsafe-${/commons-io/commons-io}"/>
-      <signaturesFileSet dir="${common.dir}/tools/forbiddenApis">
-        <include name="base.txt" />
-        <include name="servlet-api.txt" />
-      </signaturesFileSet>
-      <fileset dir="${basedir}/build">
-        <include name="**/*.class" />        
-        <!-- violates the servlet-api restrictions, but it is safe to do so in this test: -->
-        <exclude name="solr-solrj/classes/test/org/apache/solr/client/solrj/impl/BasicHttpSolrServerTest$DebugServlet.class"/>
-      </fileset>
-    </forbidden-apis>
-  </target>
-
-  <target name="-check-forbidden-test-apis">
-    <forbidden-apis signaturesFile="${common.dir}/tools/forbiddenApis/tests.txt" classpathref="forbidden-apis.classpath" failOnMissingClasses="false">
-      <fileset dir="${basedir}/build">
-        <include name="**/classes/test/**/*.class"/>
-        <include name="solr-test-framework/**/*.class"/>
-        <!-- not actually a test -->
-        <exclude name="solr-core/classes/test/org/apache/solr/search/DocSetPerf.class"/>
-        <!-- imported code -->
-        <exclude name="solr-core/classes/test/org/apache/solr/internal/**/*.class"/>
-      </fileset>
-    </forbidden-apis>
-  </target>
-
   <!-- rat sources -->
   <!-- rat-sources-typedef is *not* a useless dependency. do not remove -->
   <target name="rat-sources" depends="rat-sources-typedef,common.rat-sources">
Index: solr/common-build.xml
===================================================================
--- solr/common-build.xml	(revision 1540497)
+++ solr/common-build.xml	(working copy)
@@ -466,6 +466,24 @@
     <contrib-crawl target="add-to-war"/>
   </target>
   
+  <!-- Forbidden API Task, customizations for Solr -->
+  <target name="-check-forbidden-base" depends="-init-forbidden-apis,compile-core,compile-test">
+    <property file="${common.dir}/ivy-versions.properties"/> <!-- for commons-io version -->
+    <forbidden-apis internalRuntimeForbidden="true" classpathref="forbidden-apis.allclasses.classpath">
+      <bundledSignatures name="jdk-unsafe-${javac.target}"/>
+      <bundledSignatures name="jdk-deprecated-${javac.target}"/>
+      <bundledSignatures name="commons-io-unsafe-${/commons-io/commons-io}"/>
+      <signaturesFileSet dir="${common.dir}/tools/forbiddenApis">
+        <include name="base.txt" />
+        <include name="servlet-api.txt" />
+      </signaturesFileSet>
+      <fileset dir="${build.dir}/classes/java" excludes="${forbidden-base-excludes}"/>
+      <fileset dir="${build.dir}/classes/test" excludes="${forbidden-tests-excludes}" erroronmissingdir="false"/>
+    </forbidden-apis>
+  </target>
+  
+  <target name="-check-forbidden-sysout"/>
+
   <!-- hack for now to disable *all* Solr tests on Jenkins when "tests.disable-solr" property is set -->
   <target name="test" unless="tests.disable-solr">
     <antcall target="common.test" inheritrefs="true" inheritall="true"/>
Index: solr/core/build.xml
===================================================================
--- solr/core/build.xml	(revision 1540497)
+++ solr/core/build.xml	(working copy)
@@ -23,6 +23,11 @@
   
   <property name="test.lib.dir" location="test-lib"/>
 
+  <property name="forbidden-tests-excludes" value="
+    org/apache/solr/internal/**
+    org/apache/solr/search/DocSetPerf.class
+  "/>
+
   <import file="../common-build.xml"/>
 
   <target name="compile-core" depends="compile-solrj,common-solr.compile-core"/>
Index: solr/solrj/build.xml
===================================================================
--- solr/solrj/build.xml	(revision 1540497)
+++ solr/solrj/build.xml	(working copy)
@@ -18,6 +18,11 @@
 <project name="solr-solrj" default="default">
   <description>Solrj - Solr Java Client</description>
 
+  <!-- violates the servlet-api restrictions, but it is safe to do so in this test: -->
+  <property name="forbidden-tests-excludes" value="
+    org/apache/solr/client/solrj/impl/BasicHttpSolrServerTest$DebugServlet.class
+  "/>
+
   <import file="../common-build.xml"/>
 
   <!-- Specialized compile classpath: to only depend on what solrj should depend on (e.g. not lucene) -->
Index: solr/test-framework/build.xml
===================================================================
--- solr/test-framework/build.xml	(revision 1540497)
+++ solr/test-framework/build.xml	(working copy)
@@ -46,6 +46,16 @@
   <!-- redefine the clover setup, because we dont want to run clover for the test-framework -->
   <target name="-clover.setup" if="run.clover"/>
 
+  <!-- redefine the test compilation, so its just a no-op -->
+  <target name="compile-test"/>
+  
+  <!-- redefine the forbidden apis for tests, as we check ourselves -->
+  <target name="-check-forbidden-tests" depends="-init-forbidden-apis,compile-core">
+    <forbidden-apis signaturesFile="${common.dir}/tools/forbiddenApis/tests.txt" classpathref="forbidden-apis.allclasses.classpath"> 
+      <fileset dir="${build.dir}/classes/java"/>
+    </forbidden-apis>
+  </target>
+
   <!-- Override common-solr.javadocs to include JUnit links -->
   <!-- and to copy the built javadocs to ${dest}/docs/api/test-framework -->
   <target name="javadocs"