#271 Dozer could fail to correctly map an object graph

Dozer v5.3.0

In our application one of our mappings failed due to a NullPointerException. The exception was being thrown by the equals method of one of our classes, being called on an empty instance (all properties set to null) just created by Dozer.

Upon further investigation we disocvered the equals method was being called because Dozer code was calling the contains method on an object list, to check if the newly created instance was already included in the list. The problematic code is in the MappedFieldsTracker, in its put method:

public void put(Object src, Object dest) {
List<Object> mappedTo = mappedFields.get(src);
if (mappedTo == null) {
mappedTo = new ArrayList<Object>();
mappedFields.put(src, mappedTo);
if (!mappedTo.contains(dest)) {

This code seems to be used to correctly map object graphs. To achieve this it correctly uses an IdentityHashMap, so key inclusion in the map is based in reference equality (==) instead of object equality (equals). But the value part is implemented using a list, and inclusion in the list is checked using contains, so here YOU'RE INCORRECTLY USING OBJECT EQUALITY.

I guess this could cause Dozer to fail to properly map certain object graphs, if somebody provides a wrong equals implementation. Anyway, I think Dozer shouldn't call equals or hashCode in this case, as the call is usually made on empty instances with all properties set to null.

We've found this behavior mapping classes in a hierarchy, when you provide an explicit mapping (even if the mapping is empty, with wildcard = true)


  • dmitry (lv)

    dmitry (lv) - 2010-09-03
    • milestone: 1129554 --> Dozer v5.3.0
    • assigned_to: nobody --> buzdin
    • status: open --> closed-fixed
  • dmitry (lv)

    dmitry (lv) - 2010-09-03

    Fixed in trunk. Now dozer will use object identity in MappedFieldsTracker and not call equals or hashCode.


Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

No, thanks