Page History

Misuse of synchronization primitives is a common source of concurrency issues. Synchronizing on objects that may be reused can result in deadlock and non-deterministic behavior.

Noncompliant Code Example (Boolean

...

Lock Object)

This noncompliant code example synchronizes on a Boolean lock object.

...

The Boolean type is unsuitable for locking purposes because it allows only two values: TRUE and FALSE. Boolean literals containing the same value share unique instances of class Boolean in the Java Virtual Machine (JVM). In this example, initialized references the instance corresponding to the value FALSE. If any other code inadvertently synchronizes on a Boolean literal with the value FALSE, the lock instance is reused and the system may can become unresponsiveness or deadlockdeadlocked.

Noncompliant Code Example (

...

Boxed Primitive)

This noncompliant code example locks on a boxed Integer object.

...

This compliant solution recommends locking on a non-boxed Integer. The doSomething() method synchronizes using the intrinsic lock of the Integer instance, Lock.

...

When explicitly constructed, an Integer object has a unique reference and its own intrinsic lock that is not shared with other Integer objects or boxed integers having the same value. While this is an acceptable solution, it may can cause maintenance problems because developers might can incorrectly assume that boxed integers are appropriate lock objects. A more appropriate solution is to synchronize on an internal private final lock Object as described in the following compliant solution.

Noncompliant Code Example (

...

Interned String

...

Object)

This noncompliant code example locks on an interned String object.

...

According to the Java API \[[API 06|AA. Java References#API 06]\], class {{java.lang.String}} documentation:

When the intern() method is invoked, if the pool already contains a string equal to this String object as determined by the equals(Object) method, then the string from the pool is returned. Otherwise, this String object is added to the pool and a reference to this String object is returned.

Consequently, an interned String object behaves like a global variable in the Java Virtual Machine ( JVM). As demonstrated in this noncompliant code example, even if every instance of an object maintains its own field lock, the field references a common String constant. Locking on String constants has the same problem as locking on Boolean constants.

Additionally, hostile code from any other package can exploit this vulnerability if the class is accessible. (For more information, see the guideline CON04-J. Synchronize using an internal private final lock object.).

Noncompliant Code Example (String

...

Literal)

This noncompliant code example locks on a final String literal.

...

A String literal is a constant and is interned. Consequently, it suffers from the same pitfalls as the preceding noncompliant code example.

Compliant Solution (String

...

Instance)

This compliant solution locks on a String instance that is not interned.

...

A String instance differs from a String literal. The instance has a unique reference and its own intrinsic lock that is not shared by other string object instances or literals. A better approach is to synchronize on an internal private final lock object as shown in the following compliant solution.

Compliant Solution (

...

Internal Private Final Lock Object)

This compliant solution synchronizes on an internal private final lock object. This is one of the few cases where a java.lang.Object instance is useful.

...

For more information on using an Object as a lock, see the guideline CON04-J. Synchronize using an internal private final lock object.

...

A significant number of concurrency vulnerabilities arise from locking on the wrong kind of object. It is important to consider the properties of the the lock object rather than indiscreetly scavenging for objects to synchronize on.

...

The following table summarizes the examples flagged as violations by FindBugs:

Related Vulnerabilities

Search for Any vulnerabilities resulting from the violation of this rule are listed on the CERT website.

References

\[[API 06|AA. Java References#API 06]\] Class String, Collections
\[[Findbugs 08|AA. Java References#Findbugs 08]\]. 
\[[Pugh 08|AA. Java References#Pugh 08]\] "Synchronization"
\[[Miller 09|AA. Java References#Miller 09]\] Locking
\[[Tutorials 08|AA. Java References#Tutorials 08]\] [Wrapper Implementations|http://java.sun.com/docs/books/tutorial/collections/implementations/wrapper.html]

...