Page History

...

You can create that instance using lazy initialization, which means that the instance is not created when the class loads, but when it is first used.

Noncompliant Code Example

When the getter method is called by two threads or classes simultaneously can lead in multiple instances of the singleton class if you neglect to use synchronization, which is a common mistake that happens with that implementation.

public class MySingleton {
 private static MySingleton _instance;

 private MySingleton() {
  // construct object . . .
 // private constructor prevents instantiation by outside callers
 }

 // lazy initialization
//error, no synchronization on method
 public static MySingleton getInstance() {
  if (_instance==null) {
   _instance = new MySingleton();
  }
  return _instance;
 }
  // Remainder of class definition . . .
}

Compliant Solution

Noncompliant Code Example

Multiple instances can be created even if you add a synchronized(this) block to the constructor call.

// Also an error, synchronization does not prevent
// two calls of constructor.
public static MySingleton getInstance() {
 if (_instance==null) {
   synchronized (MySingleton.class) {
      _instance = new MySingleton();
   }
 }
 return _instance;
}

Compliant Solution

To avoid that, make the getInstance() a synchronized method. This compliant solution uses notifyAll() which sends notifications to all threads that wait on the same object. As a result, liveness is not affected unlike the noncompliant example. Ensure that the lock is released promptly after the call to notifyAll().

else if(number == 3) {
  Thread.sleep(2000);
  list.notifyAll();
public class MySingleton {

 private static MySingleton _instance;

 private MySingleton() {
  // construct object . . .
  // private constructor prevents instantiation by outside callers
 }

 // lazy initialization
 public static synchronized MySingleton getInstance() {
  if (_instance==null) {
   _instance = new MySingleton();
  }
  return _instance;
 }
  // Remainder of class definition . . .
}

Risk Assessment

To guarantee the liveness of a system, the method notifyAll() should be called rather than notify().

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[JLS 05|AA. Java References#JLS 05]\] [Chapter 17, Threads and Locks|http://java.sun.com/docs/books/jls/third_edition/html/memory.html]
\[[Goetz 06|AA. Java References#Goetz 06]\] Section 14.2.4, Notification
\[[Bloch 01|AA. Java References#Bloch 01]\] Item 50: Never invoke wait outside a loop

...