JDK-6355660 : (coll) Vector(Collection) constructor is not thread safe
  • Type: Bug
  • Component: core-libs
  • Sub-Component: java.util:collections
  • Affected Version: 6
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2005-11-28
  • Updated: 2012-10-08
  • Resolved: 2005-12-03
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6
6 b63Fixed
Related Reports
Relates :  
Relates :  
Description
Academic researchers often go looking for concurrency bugs,
and when investigating the Java libraries, the Vector(Collection)
constructor is usually the first one they find.  E.g.

http://www.cs.sunysb.edu/~liqiang/atomicity-introduction.htm
http://www.soe.ucsc.edu/~cormac/papers/tldi05.ps

Pretty much any user expects that, since Vector is synchronized
and "thread-safe", then the following is safe:

Collection c = new Vector();
// Mutate c wildly
Vector v = new Vector(c);

Of course, Vector cannot assume that its argument is not being
concurrently mutated.  Fortunately, c.toArray() is perfect for
initializing Vector's own internal array.

This is part of the fix for
6347106: (coll) methods taking concurrently modified collection arguments fail sporadically

Comments
SUGGESTED FIX --- /u/martin/ws/mustang/src/share/classes/java/util/Vector.java 2005-10-10 13:55:05.506299000 -0700 +++ /u/martin/ws/jsr166/src/share/classes/java/util/Vector.java 2005-11-24 17:38:30.821169000 -0800 @@ -147,11 +147,11 @@ * @since 1.2 */ public Vector(Collection<? extends E> c) { - elementCount = c.size(); - // 10% for growth - elementData = new Object[ - (int)Math.min((elementCount*110L)/100,Integer.MAX_VALUE)]; - c.toArray(elementData); + elementData = c.toArray(); + elementCount = elementData.length; + // c.toArray might (incorrectly) not return Object[] (see 6260652) + if (elementData.getClass() != Object[].class) + elementData = Arrays.copyOf(elementData, elementCount, Object[].class); }
28-11-2005

EVALUATION Yes.
28-11-2005