On Thu, 9 Jul 2026 01:37:20 GMT, Jason Mehrens <[email protected]> wrote:
>> src/java.base/share/classes/java/util/PriorityQueue.java line 308: >> >>> 306: if (cClass != ArrayList.class) >>> 307: es = Arrays.copyOf(es, len, Object[].class); >>> 308: if (len == 1 || this.comparator != null) >> >> A comment explaining the `len == 1`-case would be good > > @viktorklang-ora PriorityQueue has the same failure mode as JDK-5045147. See > test cases > > https://github.com/openjdk/jdk/commit/deb8d5a4ffa502339cfda14ae34aff8a94dcfd40 > > I am able to poison a PriorityQueue: > 1. Use rawtypes > 2. Add 1 object to an ArrayList > 3. Create a PriorityQueue using copy constructor. > 4. PriorityQueue will contain one non-comparable element when it should > reject. > > The other way to poison the PriorityQueue is to: > 1. Use rawtypes > 2. Create a subclass of TreeSet that uses a comparator with non-comparable > objects. > 3. Override TreeSet subclass so comparator method lies and returns null. > 4. Create a PriorityQueue using copy constructor. > 5. PriorityQueue will contain one non-comparable element when it should > reject. > > Fix is here is mostly the same as the fix for TreeMap (self compare if size > is one). > > I think this screening loop for null could be dropped if we always create > null hostile adapter over the current comparator and pass that to heapify. Sorry for the late reply, and thanks for pointing this out. I filled a issue for the problem you pointed out. After looking at it more closely, I also realised that rawtypes are not actually necessarty to reproduce it. This also exposed a new `addAll` fast path, so I changed it to explicitly validate `Comparable` elements when natural ordering is used and added regression tests. For `null` checking, I kept the explict screening loop since `heapify` does not necessarily perform any comparisons, for example with a single element. ------------- PR Review Comment: https://git.openjdk.org/jdk/pull/31701#discussion_r3767489182
