Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Wiki Markup
            When certain kinds of errors are detected, such as irrecoverable logic errors, rather than risk data corruption by continuing to execute in an indeterminate state, the appropriate strategy may be for the system to quickly shut down, allowing the operator to start it afresh in a determinate state.
\[[ISO/IEC TR 24772:2010|AA. Bibliography#ISO/IEC TR 24772-2010]\] Section 6.46, "Termination Strategy \[REU\]," says:

...

Wiki Markup
{{Runtime.halt()}} works similarly but does NOT_not_ run shutdown hooks or finalizers. According to the Java API \[[API 06|AA. Bibliography#API 06]\],

Forcibly terminates the currently running Java virtual machine. This method never returns normally.
This method should be used with extreme caution. Unlike the exit method, this method does not cause shutdown hooks to be started and does not run uninvoked finalizers if finalization-on-exit has been enabled. If the shutdown sequence has already been initiated then this method does not wait for any running shutdown hooks or finalizers to finish their work.

...

Code Block
bgColor#ffcccc
public class CreateFile {
  public static void main(String[] args) throws FileNotFoundException {
    final PrintStream out = new PrintStream(new BufferedOutputStream(
                                        new FileOutputStream("foo.txt")));
    Runtime.getRuntime().addShutdownHook(new Thread(new Runnable() {
        public void run() {
          out.close();
        }
      }));
    out.println("hello");
    Runtime.getRuntime().halt(1);
  }
}

Noncompliant Code Example (

...

Signal)

When a user forcefully exits a program by pressing the ctrl + c key or by using the kill command, the JVM terminates abruptly. Although this event cannot be captured, the program should nevertheless perform any mandatory clean-up operations before exiting. This noncompliant code example fails to do so.

...

Wiki Markup
According to the Java API \[[API 2006|AA. Bibliography#API 06]\] Class {{Runtime}}, method {{addShutdownHook}},

A shutdown hook is simply an initialized but unstarted thread. When the virtual machine begins its shutdown sequence it will start all registered shutdown hooks in some unspecified order and let them run concurrently. When all the hooks have finished it will then run all uninvoked finalizers if finalization-on-exit has been enabled. Finally, the virtual machine will halt. Once the shutdown sequence has begun it can be stopped only by invoking the halt method, which forcibly terminates the virtual machine. Once the shutdown sequence has begun it is impossible to register a new shutdown hook or de-register a previously-registered hook.

Some precautions must be taken because the JVM might be in a sensitive state during shutdown. Shutdown hook threads should:

  • be light-weight lightweight and simple
  • be thread safe
  • hold locks when accessing data and release those locks when done
  • Wiki Markup
    lack reliance on system services, asbecause the services themselves may be shutting down (for example, the logger may shut shutdowndown from another hook). Instead of one service it may be better to run a series of shutdown tasks from one thread by using a single shutdown hook \[[Goetz 2006|AA. Bibliography#Goetz 06]\].

...

The JVM can abort for external reasons, such as an external SIGKILL signal (UNIX) or the TerminateProcess call (Microsoft Windows), or memory corruption caused by native methods. Shutdown hooks may fail to execute as expected in such cases , because the JVM cannot guarantee that they will be executed as intended.

...

The CERT C Secure Coding Standard

ERR04-C. Choose an appropriate termination strategy

The CERT C++ Secure Coding Standard

ERR04-CPP. Choose an appropriate termination strategy

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="dbf22d3ec3182a48-fa0cf419-4cf8493d-b0bc860e-6a0cd9bbfd52bbc075e13a6a"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Termination Strategy [REU]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE ID -705, "Incorrect Control Flow Scoping"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1e3c9c8604638d50-1fda9283-42884053-a112a566-9a93ede5966ef32d458c9ef3"><ac:plain-text-body><![CDATA[

[[API 06

AA. Bibliography#API 06]]

[Class Runtime

http://download.oracle.com/javase/6/docs/api/java/lang/Runtime.html]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="264275a22c32e011-72aa74ce-49a240ca-b3b9b882-1ee4ccb58d547f1bc627ed9e"><ac:plain-text-body><![CDATA[

[[ISO/IEC TR 24772:2010

AA. Bibliography#ISO/IEC TR 24772-2010]]

Section 6.46, "Termination Strategy [REU]"

]]></ac:plain-text-body></ac:structured-macro>

...