EXP07-J. Understand the differences between bitwise and logical operators

The conditional AND and OR operators (&& and ||, respectively) exhibit short-circuit behavior. That is, the second operand is evaluated only when the result of the conditional operator cannot be deduced solely by evaluating the first operand. Consequently, when the result of the conditional operator can be deduced solely from the result of the first operand, the second operand will remain unevaluated; its side-effects, if any, will never occur.

The bitwise AND and OR operators (& and |) do not this behavior. They, like most other Java operators, evaluate both operands, starting with the left operand, and then the right. They return the same result as && and || respectively.

Consequently it is useful to use either & or && when performing Boolean logic. However, there are times when the short-circuiting behavior is preferred, and other times when the short-circuiting behavior causes subtle bugs.

Noncompliant Code Example (Improper &)

In this noncompliant code example, derived from [[Flanagan 2005]], we have two variables, with no guarantees as to their current values. The code attempts to check if array[i] is nonnegative, but first it must validate its data.

int array[]; // may be null
int i;       // may be a valid index for array
if (array != null &
    i >= 0 & i < array.length &
    array[i] >= 0) {
  // handle array
} else {
  // handle error
}

Unfortunately this code may fail due to the very errors it is trying to prevent. If array is null or i is not a valid index, the reference to arrayi will cause a NullPointerException or ArrayIndexOutOfBoundsException to be thrown. This happens because the & operator does not prevent its right operands from being evaluated, even if its left operands prove that they are invalid.

Compliant Solution (Use &&)

This compliant solution mitigates the problem by using &&, which causes the conditional expression to terminate immediately if any of the conditions fail, thereby preventing a potentially-invalid evaluation.

int array[]; // may be null
int i;       // may be a valid index for array
if (array != null &&
    i >= 0 & i < array.length &&
    array[i] >= 0) {
  // handle array
} else {
  // handle error
}

Compliant Solution (Nested If Statements)

This compliant solution uses multiple if statements to achieve the proper effect. While correct, it is more verbose.

int array[]; // may be null
int i;       // may be a valid index for array
if (data != null) {
  if (i >= 0 & i < data.length) {
    if (data[i] != -1) {
     // handle array
    } else {
      // handle error
    }
  } else {
    // handle error
  }
} else {
  // handle error
}

This solution could be useful if the error-handling routines for each potential condition failure were different.

Noncompliant Code Example (Improper &&)

This noncompliant code example demonstrates code that compares two arrays for ranges of members that match. Here i1 and i2 are valid array indices in array1 and array2 respectively. It is expected that end1 and end2 will point to the end of the matching ranges in the two arrays.

if (end1 >= 0 & i2 >= 0) {
  int begin1 = i1;
  int begin2 = i2;
  while (++i1 < array1.length &&
         ++i2 < array2.length &&
         array1[i1] == array2[i2]) {
    // arrays match so far
  }
  int end1 = i1;
  int end2 = i2;
  assert end1 - begin1 == end2 - begin2;
}

The problem with this code is that if the first condition in the while loop fails, the second condition is not executed. That is, once i1 has reached array1.length, the loop may terminate after i1 is executed. Consequently the range over array1 is larger than the range over array2, causing the final assertion to fail.

Compliant Solution (Use &)

This compliant solution mitigates the problem by using &, which guarantees that both i1 and i2 are incremented, regardless of the outcome of the first condition.

  while (++i1 < array1.length &     // not &&
         ++i2 < array2.length &&
         array1[i1] == array2[i2])

Compliant Solution (Nested If Statements)

This compliant solution uses multiple if statements to achieve the proper effect. While correct, it is more verbose.

  while (true) {
    if (++i1 >= array1.length) break;
    if (++i2 >= array2.length) break;
    if (array1[i1] != array2[i2]) break;
    // rest of loop
  }

Risk Assessment

Failure to understand the behavior of the bitwise and conditional operators can cause unintended program behavior.

Related Guidelines

CERT C Secure Coding Standard: EXP02-C. Be aware of the short-circuit behavior of the logical AND and OR operators
CERT C++ Secure Coding Standard: EXP02-CPP. Be aware of the short-circuit behavior of the logical AND and OR operators

Bibliography

[[Flanagan 2005]] 2.5.6. Boolean Operators
[[JLS 2005]] Sections 15.23 "Conditional-And Operator &&" and 15.24 "Conditional-Or Operator ||"

EXP06-J. Use parentheses for precedence of operation      04. Expressions (EXP)      EXP08-J. Understand the evaluation of expressions containing non-short-circuit operators