-
Bug
-
Resolution: Fixed
-
P3
-
1.1.7
-
None
-
beta
-
generic
-
generic
-
Verified
There is a race condition in the java.util.Vector class. It occurs because the single
argument version of lastIndexOf reads elementCount without being synchronized.
A different thread can remove elements and trim the array before the synchronized
version of lastIndexOf is invoked, causing an array bounds exception.
Run the following program using "java C":
---
import java.util.*;
class Shared extends Thread {
static public Vector v;
static {
v = new Vector();
v.addElement(v);
v.addElement(v);
v.addElement(v);
}
static void Sleep(int mills) {
try {
Thread.sleep(mills);
} catch (Exception e) {
}
}
public void run() {
synchronized(v) {
Sleep(200);
v.removeElementAt(0);
v.trimToSize();
}
}
}
class C extends Thread{
public void run(){
Shared.Sleep(100);
Shared.v.lastIndexOf(Shared.v);
}
public static void main(String args[]){
new Shared().start();
new C().start();
}
}
---
it outputs the following:
~/proj> java C
java.lang.ArrayIndexOutOfBoundsException
at java.util.Vector.lastIndexOf(Compiled Code)
at java.util.Vector.lastIndexOf(Compiled Code)
at C.run(Compiled Code)
~/proj>
Here is the version information, but the same bug appears all versions:
~/proj> java -version
java version "1.1.7B-2"
~/proj> java -fullversion
java full version "JDK1.1.7:01/04/1999-19:30"
(Review ID: 95322)
======================================================================
argument version of lastIndexOf reads elementCount without being synchronized.
A different thread can remove elements and trim the array before the synchronized
version of lastIndexOf is invoked, causing an array bounds exception.
Run the following program using "java C":
---
import java.util.*;
class Shared extends Thread {
static public Vector v;
static {
v = new Vector();
v.addElement(v);
v.addElement(v);
v.addElement(v);
}
static void Sleep(int mills) {
try {
Thread.sleep(mills);
} catch (Exception e) {
}
}
public void run() {
synchronized(v) {
Sleep(200);
v.removeElementAt(0);
v.trimToSize();
}
}
}
class C extends Thread{
public void run(){
Shared.Sleep(100);
Shared.v.lastIndexOf(Shared.v);
}
public static void main(String args[]){
new Shared().start();
new C().start();
}
}
---
it outputs the following:
~/proj> java C
java.lang.ArrayIndexOutOfBoundsException
at java.util.Vector.lastIndexOf(Compiled Code)
at java.util.Vector.lastIndexOf(Compiled Code)
at C.run(Compiled Code)
~/proj>
Here is the version information, but the same bug appears all versions:
~/proj> java -version
java version "1.1.7B-2"
~/proj> java -fullversion
java full version "JDK1.1.7:01/04/1999-19:30"
(Review ID: 95322)
======================================================================