CharsetDecoder has a number of issues that need to be fixed:

1. The constructor that takes a replacement stores a reference to the byte[] and so it may be changed without going through the replaceWith method. In addition the constructor doesn't check that the replacement characters are legal.

2. The replacement method hands out a reference to the internal byte[] array, leading to the same issue as 1.

3. replaceWith has the same issue as the constructor, it stores a reference to the byte array rather than taking a copy.

Although the above issues need to be fixed they aren't actually an issue for the single byte charsets because the implementation takes a copy of the replacement byte. So it's mostly only an issue for double byte charsets.