On Wed, 8 Jul 2026 09:51:10 GMT, Viktor Klang <[email protected]> wrote:
>> Daisuke Yamazaki has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Revert redundant styling > > src/java.base/share/classes/java/util/PriorityQueue.java line 308: > >> 306: if (cClass != ArrayList.class) >> 307: es = Arrays.copyOf(es, len, Object[].class); >> 308: if (len == 1 || this.comparator != null) > > A comment explaining the `len == 1`-case would be good @viktorklang-ora PriorityQueue has the same failure mode as JDK-5045147. See test cases https://github.com/openjdk/jdk/commit/deb8d5a4ffa502339cfda14ae34aff8a94dcfd40 I am able to poison a PriorityQueue: 1. Use rawtypes 2. Add 1 object to an ArrayList 3. Create a PriorityQueue using copy constructor. 4. PriorityQueue will contain one non-comparable element when it should reject. The other way to poison the PriorityQueue is to: 1. Use rawtypes 2. Create a subclass of TreeSet that uses a comparator with non-comparable objects. 3. Override TreeSet subclass so comparator method lies and returns null. 4. Create a PriorityQueue using copy constructor. 5. PriorityQueue will contain one non-comparable element when it should reject. Fix is here is mostly the same as the fix for TreeMap (self compare if size is one). I think this screening loop for null could be dropped if we always create null hostile adapter over the current comparator and pass that to heapify. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/31701#discussion_r3548269117
