I have a number of concerns with this proposed change:

1. Writers generally do throw NPEs when called with null.

2. I'm not convinced 35410 should have been fixed since toString() should never return null (else all sorts of standard code patterns break).

3. The patch should ideally include a test case.

4. The proposed patch only addresses one possible NPE of many.

What is your stacktrace and in what case this issue is triggered?


1. I agree with Mark that Writer.write((String)null) should throw an NPE

2. Regarding bug 35410 I think that the fix is wrong but in another way

Expressions are defined in two places in JSP 2.2,
a) JSP.1.12.3 "Expressions"
b) JSP.9.4.3 "Expressions"

b) says that <%= expr %> is out.print(expr)
and JspWriter.print(String) is defined to print null value as "null", not "".

So using the test from bug 35410 I expect "null null null". The actual result in 7.0.33 is "null null".

The generated java code is
      out.print( test );

I think it should generate
      out.print( String.valueOf(test) );


The behaviour of JspWriterImpl.print(Object) could be "improved" to handle obj.toString() returning null,  but I do not think that such change is needed, because its current behaviour is consistent with PrintWriter.print(Object) which results in an NPE.

My reading is that the spec says that the value of the expression should be coerced to String *before* printing it.

+1 to Konstantin's analysis. I'll work on a test case and patch based on bug 35410. We could re-open that one but since it is for 5.5.x which is now unsupported I'd rather just deal with it here.

The proposed patch was not applied and the previous fix for bug 35410 has been reverted. The changes will be in Tomcat 7.0.35 onwards.