From b8b85a6a59db19ae3283becadf7f60de606d5616 Mon Sep 17 00:00:00 2001
From: Juergen Hoeller <hoellerj@vmware.com>
Date: Tue, 14 Sep 2021 21:49:23 +0200
Subject: [PATCH] Defensive handling of dimensions nullability

---
 .../spel/ast/ConstructorReference.java        | 37 ++++++++++---------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/spring-expression/src/main/java/org/springframework/expression/spel/ast/ConstructorReference.java b/spring-expression/src/main/java/org/springframework/expression/spel/ast/ConstructorReference.java
index 7ccc4c16d962..d42a375410f6 100644
--- a/spring-expression/src/main/java/org/springframework/expression/spel/ast/ConstructorReference.java
+++ b/spring-expression/src/main/java/org/springframework/expression/spel/ast/ConstructorReference.java
@@ -57,7 +57,7 @@
  */
 public class ConstructorReference extends SpelNodeImpl {
 
-	private boolean isArrayConstructor = false;
+	private final boolean isArrayConstructor;
 
 	@Nullable
 	private SpelNodeImpl[] dimensions;
@@ -234,6 +234,7 @@ private TypedValue createArray(ExpressionState state) throws EvaluationException
 					FormatHelper.formatClassNameForMessage(
 							intendedArrayType != null ? intendedArrayType.getClass() : null));
 		}
+
 		String type = (String) intendedArrayType;
 		Class<?> componentType;
 		TypeCode arrayTypeCode = TypeCode.forName(type);
@@ -243,7 +244,8 @@ private TypedValue createArray(ExpressionState state) throws EvaluationException
 		else {
 			componentType = arrayTypeCode.getType();
 		}
-		Object newArray;
+
+		Object newArray = null;
 		if (!hasInitializer()) {
 			// Confirm all dimensions were specified (for example [3][][5] is missing the 2nd dimension)
 			if (this.dimensions != null) {
@@ -252,23 +254,22 @@ private TypedValue createArray(ExpressionState state) throws EvaluationException
 						throw new SpelEvaluationException(getStartPosition(), SpelMessage.MISSING_ARRAY_DIMENSION);
 					}
 				}
-			}
-			TypeConverter typeConverter = state.getEvaluationContext().getTypeConverter();
-
-			// Shortcut for 1 dimensional
-			if (this.dimensions.length == 1) {
-				TypedValue o = this.dimensions[0].getTypedValue(state);
-				int arraySize = ExpressionUtils.toInt(typeConverter, o);
-				newArray = Array.newInstance(componentType, arraySize);
-			}
-			else {
-				// Multi-dimensional - hold onto your hat!
-				int[] dims = new int[this.dimensions.length];
-				for (int d = 0; d < this.dimensions.length; d++) {
-					TypedValue o = this.dimensions[d].getTypedValue(state);
-					dims[d] = ExpressionUtils.toInt(typeConverter, o);
+				TypeConverter typeConverter = state.getEvaluationContext().getTypeConverter();
+				if (this.dimensions.length == 1) {
+					// Shortcut for 1-dimensional
+					TypedValue o = this.dimensions[0].getTypedValue(state);
+					int arraySize = ExpressionUtils.toInt(typeConverter, o);
+					newArray = Array.newInstance(componentType, arraySize);
+				}
+				else {
+					// Multi-dimensional - hold onto your hat!
+					int[] dims = new int[this.dimensions.length];
+					for (int d = 0; d < this.dimensions.length; d++) {
+						TypedValue o = this.dimensions[d].getTypedValue(state);
+						dims[d] = ExpressionUtils.toInt(typeConverter, o);
+					}
+					newArray = Array.newInstance(componentType, dims);
 				}
-				newArray = Array.newInstance(componentType, dims);
 			}
 		}
 		else {