Page History

...

These two requirements can be counter intuitive when expressions contain side-effects. This is because , such expressions follow the left to right evaluation order irrespective of operator precedence, associativity rules and indicative parentheses.

...

This noncompliant example shows how side-effects in expressions can lead to unanticipated outcomes. The programmer intends to write access control logic based on different threshold levels. Each user has a rating that must be above the threshold , to be granted appropriate access. As shown, a simple function is used to calculate the rating. The get() method is used to provide a non-zero factor when the user is authorized and a zero value , when the user is not authorized.

In this case, the programmer expects the rightmost subexpression to evaluate first because of the greater precedence of the operator * * operator has a higher precedence than the + operator +. The parentheses reinforce this belief. These ideas lead to the incorrect conclusion that the right hand side evaluates to zero whenever the get() method returns zero. The Because the programmer expects number = 0 due to the rightmost number=get() subexpression, the test in the left hand subexpression should ideally is expected to reject the unprivileged user as because the expected rating value (number) is below the threshold of 10 (expecting number = 0, because of number=get()). Ironically. However, the program actually grants access to the unauthorized user. The reason is that evaluation of the side-effect infested subexpressions follows the left to right ordering rule and should not be confused with the tenets of operator precedence, associativity and indicative parentheses.

class BadPrecedence {
  public static void main(String[] args) {
    int number=17;
    int[] threshold = new int[20];
    threshold[0] = 10;
    number = (number > threshold[0]? 0:-2) + ((31 * ++number) * (number=get()));
    // ... 
    if(number == 0)
      System.out.println("Access granted");
    else
      System.out.println("Denied access"); // number = -2
  }
  public static int get() {
    int number=0;
    // assign number to non zero value if authorized else 0
    return number;
  }
}

Compliant Solution

While diligently Diligently following the left to right evaluation order, a programmer can expect this compliant solution to evaluate to an the expected final outcome depending on the value returned by the get() method.

...

Although this solution solves the problem, in general , it is advisable to avoid using expressions with more than one side-effect. It is also inadvisable to depend on the left-right ordering for evaluation of side-effects because operands are evaluated in place first, and then subject to laws of operator precedence and associativity.

The problematic expression could also be written to avoid expressions with side-effects. Rewriting the problematic expression in this manner allows the expression to be reordered without concern for the evaluation order of the component expressions, making the code easier to understand and maintain.

number = ((31 * (number + 1)) * get()) + (get() > threshold[0]? 0:-2);

Risk Assessment

Failing to keep in mind the evaluation order of expressions containing side effects can result in unexpected output.

...