Page History

...

• Do not depend on a finalizer for updating critical persistent state: It is possible for the JVM to terminate without invoking the finalizer on an unreachable object. Thus As a result it is not advisable to use any lock or sharing based mechanisms within an initializer. Methods such as System.gc, System.runFinalization, System.runFinalizersOnExit and Runtime.runFinalizersOnExit are either just marginally better or have been deprecated due to lack of safety and deadlock causing effects.

...

public class Foo {
  // The finalizeGuardian object finalizes the outer Foo object
  private final Object finalizerGuardian = new Object() {
    protected void finalize() throws Throwable {
    // Finalize outer Foo object
    }
  };
  //...
}

Risk Assessment

TODO

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

JLS, 12.6 Finalization of Class Instances
Effective Java: Programming Language Guide, Item 6, Avoid finalizers
Java Cookbook, Ian Darwin, 9.5 The Finalize Method
Java in a nutshell, 3.3. Destroying and Finalizing Objects
Java API Documentation http://java.sun.com/j2se/1.4.2/docs/api/java/lang/Object.html#finalize()