Page History

...

Autoboxing automatically wraps a value of a primitive type with the corresponding wrapper object. The [Section 5§5.1.7 "Boxing Conversion,"|http://java.sun.com/docs/books/jls/third_edition/html/conversions.html#5.1.7] of the _Java Language Specification_ \[[JLS 2005|AA. Bibliography#JLS 05]\] explains which primitive values are memoized during autoboxing: 

...

The == and != operators may only be used for comparing the values of boxed primitives that are not fully memoized when the range of values represented is guaranteed to be within the ranges specified by the JLS Java Language Specification to be fully memoized.

In general, avoid using these operators to compare the values of boxed primitives that are not fully memoized.

...

Less memory-limited implementations mightcould, for example, cache all characters and shorts, as well as integers and longs in the range of -32K - — +32K.

Code that depends on implementation-defined behavior is not portable.

...

This noncompliant code example uses the == operator to compare two Integer objects. According to the guideline, "EXP01-J. Do not confuse abstract object equality with reference equality," for the == operator to return true for two object references, they must point to the same underlying object.

public class Wrapper {
  public static void main(String[] args) {
    Integer i1 = 100;
    Integer i2 = 100;
    Integer i3 = 1000;
    Integer i4 = 1000;
    System.out.println(i1 == i2);
    System.out.println(i1 != i2);
    System.out.println(i3 == i4);
    System.out.println(i3 != i4);
  }
}

The Integer class only caches integer values from -127 to 128 only, which can result in equivalent values outside this range not comparing equal. For example, a JVM that did not cache any other values when running this program would output:

true
false
false
true

...

This compliant solution uses the equals() method instead of the == operator to compare the values of the objects. The program now prints true, false, true and , false on any platform, as expected.

...

Java Collections contain only objects; they cannot contain primitive types. Further, the type parameters of all Java generics must be object types rather than primitive types. That is, attempting to declare an ArrayList<int> (which would, presumably contains , contain values of type int) fails at compile time because type int is not an object type. The appropriate declaration would be ArrayList<Integer>, which makes use of the wrapper classes and autoboxing.

This noncompliant code example attempts to count the number of indices in arrays list1 and list2 that have equivalent values. Recall that class Integer need needs to memoize only those integer values in the range -127 to 128; it might return non-unique objects for all values outside that range. Consequently, when comparing autoboxed integer values outside that range, the == operator might return false, and the output of this example might be 0.

...

If the particular JVM running this code memoized integer values from -32,768 to 32,767, all of the int values in the example would have been autoboxed to singleton Integer objects, and the example code would have operated as expected. Using reference equality instead of object equality requires that all values encountered fall within the interval of values memoized by the JVM. The JLS Java Language Specification does not specify this interval; it only provides a minimum range. Consequently, successful prediction of this program's behavior would require implementation-specific details of the JVM.

...

Noncompliant Code Example (new Boolean)

Constructors In this noncompliant code example, constructors for class Boolean return distinct newly-instantiated objects. Using the reference equality operators in place of value comparisons will yield unexpected results.

...

Compliant Solution (new Boolean)

The In this compliant solution, the values of autoboxed Boolean variables may be compared using the reference equality operators because the Java language guarantees that the Boolean type is fully memoized. Consequently, these objects are guaranteed to be singletons.

...

Detection of all uses of the reference equality operators on boxed primitive objects is straightforward. Determining the correctness of such uses is infeasible in the general case.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[Bloch 2009|AA. Bibliography#Bloch 09]\] 4. "Searching for the One"
\[[JLS 2005|AA. Bibliography#JLS 05]\] [Section 5§5.1.7|http://java.sun.com/docs/books/jls/third_edition/html/conversions.html#5.1.7], "Boxing Conversion"
\[[Pugh 2009|AA. Bibliography#Pugh 09]\] Using == to compare objects rather than .equals

...