如果尝试使用反射将值设置为String类的value []字段，则Java 6和Java 7会产生不同的结果

Question

The following code attempts to set a value to the private final char value[] field of the String class using Java 7 .

package test;

import java.lang.reflect.Field;

public final class Test 
{
    static
    {
        try
        {
            Field value = String.class.getDeclaredField("value");
            value.setAccessible(true);
            value.set("Hello World", value.get("1234567890"));
        }
        catch (IllegalArgumentException | IllegalAccessException | NoSuchFieldException | SecurityException e)
        {
            System.out.println(e.toString());
        }
    }

    public static void main(String[] args) 
    {
        System.out.println("Hello World");
    }
}

and it silently displays 1234567890 on the console and there is no question about it.

---

When I try to do the same thing using Java 6 like the following,

package test;

import java.lang.reflect.Field;

public final class Test
{
    static
    {
        try
        {
            Field value = String.class.getDeclaredField("value");
            value.setAccessible(true);
            value.set("Hello World", value.get("1234567890"));
        }
        catch (IllegalArgumentException e)
        {
            System.out.println(e.toString());
        }
        catch (IllegalAccessException e)
        {
            System.out.println(e.toString());
        }
        catch (NoSuchFieldException e)
        {
            System.out.println(e.toString());
        }
        catch (SecurityException e)
        {
            System.out.println(e.toString());
        }
    }
    public static void main(String[] args)
    {
        System.out.println("Hello World");
    }
}

it causes the following exception to be thrown.

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException

It works when the length of value.get("1234567890") in this statement value.set("Hello World", value.get("1234567890")); is grater than or equal to the String Hello World

For example,

If the following statement (as in the preceding code snippet)

value.set("Hello World", value.get("1234567890"));

is replaced by something like the following

value.set("Hello World", value.get("12345678901"));

So why doesn't this work with Java 6 (or might be lower, I didn't try) when the length of the second parameter of the set() method is less than the first one?

BTW, I can understand that dealing with private fields with reflection in this way is not recommended at all and is worst.

Answer 1

So why doesn't this work with Java 6 (or might be lower, I didn't try) when the length of the second parameter of the set() method is less than the first one?

In Java 6, you're managing to set the value character array to the new reference - but you're not changing the other fields which specify the section of the char[] which the string refers to.

I can't remember the exact field names, but it's something like this:

char[] value;
int offset;
int count;

So for a string which "covers" the entire character array, offset would be 0 and count would be value.length . Now if you replace value with a shorter char[] , but don't change count , then offset + count is beyond the end of the array... it's outside the bounds of the array. This is done so that operations like substring don't need to copy the character data - they just create a new object which refers to the existing array, with different offset / count values.

In Java 7 from update 5 onwards, strings don't have this offset/count concept; instead, each string has its own character array and the start and end are implicit. I suspect that's why it works for you in Java 7.