Bug in ClassValue

[John Rose]

On Mar 11, 2012, at 9:45 AM, Rémi Forax wrote:

> Last week, Fredrik found that I've forgotten to implement ClassValue
> in the backport of jsr292.
> 
> While struggling to implement it, I've found a bug in the implementation
> of the JDK. This snippet creates an infinite loop :(
> 
>        java.lang.ClassValue<Integer> cv = new 
> java.lang.ClassValue<Integer>() {
>             @Override
>             protected Integer computeValue(Class<?> type) {
>                 remove(int.class);
>                 return 1;
>             }
>         };
>         cv.get(int.class);
> 
> while this code is naughty, I think it's a legal one.

Naughty code, nice bug.  

The spec. requires that the CV go from state 2N to state 2N+1 *after* the return from computeValue, not before.

http://cr.openjdk.java.net/~jrose/pres/indy-javadoc-mlvm/java/lang/ClassValue.html#remove(java.lang.Class)

The remove call should therefore be a no-op (assuming no concurrent calls to get) from state 2N to 2N.

I think the implementation is treating the internal state for a "pending call to computeValue" as if it were 2N+1, which causes the remove call to advance to 2N+2.  The spec. requires CV.get to retry the computeValue call in such cases, which leads to the infinite loop.

I have filed 7153157 "ClassValue.get does not return if computeValue calls remove".

Thanks Remi!

— John


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.openjdk.java.net/pipermail/mlvm-dev/attachments/20120312/ddd6d553/attachment.html