United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-7103957 NegativeArraySizeException while initializing class IntegerCache
JDK-7103957 : NegativeArraySizeException while initializing class IntegerCache

Details
Type:
Bug
Submit Date:
2011-10-23
Status:
Closed
Updated Date:
2013-06-26
Project Name:
JDK
Resolved Date:
2013-01-10
Component:
core-libs
OS:
windows_7
Sub-Component:
java.lang
CPU:
x86
Priority:
P5
Resolution:
Fixed
Affected Versions:
6u26
Fixed Versions:

Related Reports
Backport:
Backport:
Relates:

Sub Tasks

Description
FULL PRODUCT VERSION :
java version "1.6.0_27"
Java(TM) SE Runtime Environment (build 1.6.0_27-b07)
Java HotSpot(TM) 64-Bit Server VM (build 20.2-b06, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.1.7601]

A DESCRIPTION OF THE PROBLEM :
It is possible to cause a NegativeArraySizeException in the class initializer of java.lang.Integer.IntegerCache by specifying a value for the System property java.lang.Integer.IntegerCache.high greater than or equal to 2147483519 (Integer.MAX_VALUE - -low).

This is because the maximum array size for the cache is computed as:

h = Math.min(i, Integer.MAX_VALUE - -low);

Unfortunately, this does not account for caching Integer 0 for large enough values of the System property as noted above. The correct computation is:

h = Math.min(i, Integer.MAX_VALUE - -low - 1);

For the noted values, the NegativeArraySizeException occurs at the line that allocates the array:

cache = new Integer[(high - low) + 1];

Notice that caching Integer 0 is account for here by adding 1. However, (high - low) + 1 equates to Integer.MAX_VALUE + 1, thus causing overflow and the NegativeArraySizeException.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Compile the following class:

public class IntegerCacheSizeTest {
    public static void main(String[] args) {
        Integer i = 0; // Any value will do
    }
}

Run the class with any value greater than or equal to 2147483519 for the System property java.lang.Integer.IntegerCache.high. For example:

java -Djava.lang.Integer.IntegerCache.high=2147483519 IntegerCacheSizeTest


EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
No error, except perhaps a java.lang.OutOfMemoryError due to the attempted allocation of the cache array with insufficient memory.
ACTUAL -
A stack trace indicating java.lang.NegativeArraySizeException during class initialization of Integer$IntegerCache.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.ExceptionInInitializerError
        at java.lang.Integer.valueOf(Unknown Source)
        at IntegerCacheSizeTest.main(IntegerCacheSizeTest.java:3)
Caused by: java.lang.NegativeArraySizeException
        at java.lang.Integer$IntegerCache.<clinit>(Unknown Source)
        ... 2 more

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
public class IntegerCacheSizeTest {
    public static void main(String[] args) {
        Integer i = 0; // Any value will do
    }
}

---------- END SOURCE ----------

                                    

Comments
EVALUATION

A very minor correctness problem to address.
                                     
2012-01-09
URL:   http://hg.openjdk.java.net/jdk8/tl/jdk/rev/4c8b37f159f9
User:  mchung
Date:  2013-01-10 01:12:34 +0000

                                     
2013-01-10
The cause of the problem and its solution were both accurately stated in the issue description.
                                     
2013-01-10
Attach regression test (not to be committed).
                                     
2013-01-09
URL:   http://hg.openjdk.java.net/jdk8/jdk8/jdk/rev/4c8b37f159f9
User:  lana
Date:  2013-01-15 19:00:22 +0000

                                     
2013-01-15



Hardware and Software, Engineered to Work Together