Hacker News Reader

Comment by qompiler | Hacker News Reader

For this reason the Java JPasswordField getPassword() method returns an array with no other copies around. An array can also easily be zero'd out with fill().

http://docs.oracle.com/javase/tutorial/uiswing/components/pa...

View on HN

Isn't JRE using compacting GC which makes the "no copies" guarantee void anyway?

The char or int datatypes do not have their values stored as objects. When you change the value of a char inside a char[] array, that value is directly changed in ram.

This will leave the "hello" in ram (subject to GC):

  String x = "hello"
  x = null;

This will clear the "hello" from ram:

  char[] x = new char[]{'h','e','l','l','o'};
  x[0] = '0'; x[1] = '0'; ...

This will leave the "hello" in ram (subject to GC):

  char[] x = new char[]{'h','e','l','l','o'};
  x = null;

The point was about the garbage collector compacting memory regions, thus moving objects around. If you don't pin your array it could leave "hello" somewhere in memory when it's moved before you zero it.

Been a while since I've done java, but I'd assume it simply pins it?

Reply on news.ycombinator.com