...
A
...
thread
...
that
...
invokes
...
wait()
...
expects
...
to
...
wake
...
up
...
and
...
resume
...
execution
...
when
...
its
...
...
...
becomes
...
true.
...
Waiting
...
threads
...
must
...
test
...
their
...
condition
...
predicates
...
upon
...
receiving
...
notifications
...
and
...
resume
...
waiting
...
if
...
the
...
predicates
...
are
...
false,
...
to
...
be
...
compliant
...
with
...
guideline THI03-J.
...
...
...
...
...
...
...
...
...
...
.
The notify()
...
and
...
notifyAll()
...
methods
...
of
...
package
...
java.lang.Object
...
are
...
used
...
to
...
wake
...
up
...
waiting
...
thread(s).
...
These
...
methods
...
must
...
be
...
invoked
...
from
...
code
...
that
...
holds
...
the
...
same
...
object
...
lock
...
as
...
the
...
waiting
...
thread(s).
...
An
...
IllegalMonitorStateException
...
is
...
thrown
...
if
...
the
...
current
...
thread
...
does
...
not
...
acquire
...
this
...
object's
...
intrinsic
...
lock
...
before
...
invoking
...
these
...
methods.
...
The
...
notifyAll()
...
method
...
wakes
...
up
...
all
...
threads
...
and
...
allows
...
threads
...
whose
...
condition
...
predicate
...
is
...
true
...
to
...
resume
...
execution.
...
Furthermore,
...
if
...
all
...
the
...
threads
...
whose
...
condition
...
predicate
...
evaluates
...
to
...
true
...
previously
...
held
...
a
...
specific
...
lock
...
before
...
going
...
into
...
the
...
wait
...
state,
...
only
...
one
...
of
...
them
...
will
...
reacquire
...
the
...
lock
...
upon
...
being
...
notified.
...
Presumably,
...
the
...
other
...
threads
...
will
...
resume
...
waiting.
...
The
...
notify()
...
method
...
wakes
...
up
...
only
...
one
...
thread
...
and
...
makes
...
no
...
guarantees
...
as
...
to
...
which
...
thread
...
is
...
notified.
...
If
...
the
...
thread's
...
condition
...
predicate
...
doesn't
...
allow
...
the
...
thread
...
to
...
proceed,
...
the
...
chosen
...
thread
...
may
...
resume
...
waiting,
...
defeating
...
the
...
purpose
...
of
...
the
...
notification.
...
The
...
notify()
...
method
...
may
...
only
...
be
...
invoked
...
if
...
all
...
of
...
the
...
following
...
conditions
...
are
...
met:
...
- The
...
- condition
...
- predicate
...
- is
...
- identical
...
- for
...
- each
...
- waiting
...
- thread.
...
- All
...
- threads
...
- must
...
- perform
...
- the
...
- same
...
- set
...
- of
...
- operations
...
- after
...
- waking
...
- up.
...
- This
...
- means
...
- that
...
- any
...
- one
...
- thread
...
- can
...
- be
...
- selected
...
- to
...
- wake
...
- up
...
- and
...
- resume
...
- for
...
- a
...
- single
...
- invocation
...
- of
...
notify()
...
- .
...
- Only
...
- one
...
- thread
...
- is
...
- required
...
- to
...
- wake
...
- upon
...
- the
...
- notification.
...
These
...
conditions
...
are
...
satisfied
...
by
...
threads
...
that
...
are
...
identical
...
and
...
provide
...
a
...
stateless
...
service
...
or
...
utility.
...
The
...
java.util.concurrent
...
utilities
...
(Condition interface
...
)
...
provide
...
the
...
signal()
...
and
...
signalAll()
...
methods
...
to
...
awaken
...
threads
...
that
...
are
...
blocked
...
on
...
an
...
await()
...
call.
...
Condition
...
objects
...
are
...
required
...
when
...
using
...
Lock
...
objects.
...
A
...
Lock
...
object
...
allows
...
the
...
use
...
of
...
wait()
...
and
...
notify()
...
methods.
...
However,
...
code
...
that
...
synchronizes
...
using
...
a
...
Lock
...
object
...
does
...
not
...
use
...
its
...
own
...
intrinsic
...
lock.
...
Instead,
...
one
...
or
...
more
...
Condition
...
objects
...
are
...
associated
...
with
...
the
...
Lock
...
object.
...
These
...
objects
...
interact
...
directly
...
with
...
the
...
locking
...
policy
...
enforced
...
by
...
the
...
Lock
...
object.
...
Consequently,
...
the
...
Condition.await()
...
,
...
Condition.signal()
...
, and Condition.signalAll()
...
methods
...
are
...
used
...
instead
...
of
...
Object.wait()
...
,
...
Object.notify()
...
, and Object.notifyAll()
...
.
...
The
...
use
...
of
...
the signal()
...
method is
...
insecure
...
when
...
multiple
...
threads
...
await
...
the
...
same
...
Condition
...
object
...
unless
...
the
...
following
...
conditions
...
are
...
met:
- The
Conditionobject is identical for each waiting thread. - All threads must perform the same set of operations after waking up. This means that any one thread can be selected to wake up and resume for a single invocation of
signal(). - Only one thread is required to wake upon receiving the signal.
The signal() method may also be invoked when both of the following conditions are met:
- Each thread uses a unique
Conditionobject. - Each
Conditionobject is associated with a commonLockobject.
The signal() method, if used securely, has better performance than signalAll().
Noncompliant Code Example (notify())
This noncompliant code example shows a complex multistep process being undertaken by several threads. Each thread executes the step identified by the time field. Each thread waits for the time field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread increments time and then notifies the thread that is responsible for the next step.
| Code Block | ||
|---|---|---|
| ||
* The {{Condition}} object is identical for each waiting thread. * All threads must perform the same set of operations after waking up. This means that any one thread can be selected to wake up and resume for a single invocation of {{signal()}}. * Only one thread is required to wake upon receiving the signal. The {{signal()}} method may also be invoked when: * Each thread uses a unique {{Condition}} object. * Each {{Condition}} object is associated with a common {{Lock}} object. The {{signal()}} method, if used securely, has better performance than {{signalAll()}}. h2. Noncompliant Code Example ({{notify()}}) This noncompliant code example shows a complex multi-step process being undertaken by several threads. Each thread executes one step of the process; the step being performed is indicated by the {{time}} field. Each thread waits for the {{time}} field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread increments {{time}} to transfer control to the next thread. Next, the thread notifies the thread that is responsible for the next step and then exits. {code:bgColor=#FFcccc} public final class ProcessStep implements Runnable { private static final Object lock = new Object(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } @Override public void run() { try { synchronized (lock) { while (time != step) { lock.wait(); } // Perform operations time++; lock.notify(); } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } } public static void main(String[] args) { for (int i = 4; i >= 0; i--) { new Thread(new ProcessStep(i)).start(); } } } {code} |
This
...
noncompliant
...
code
...
example
...
violates
...
the
...
...
property.
...
Each
...
thread
...
has
...
a
...
different
...
condition
...
predicate,
...
as
...
each
...
requires
...
step
...
to
...
have
...
a
...
different
...
value
...
before
...
proceeding.
...
The
...
Object.notify()
...
method wakes
...
up
...
only
...
one
...
thread
...
at
...
a
...
time.
...
Unless
...
it
...
happens
...
to
...
wake
...
up
...
the
...
thread
...
that
...
is
...
required
...
to
...
perform
...
the
...
next
...
step,
...
the
...
program
...
will
...
deadlock.
...
Compliant Solution (notifyAll()
...
)
...
In
...
this
...
compliant
...
solution,
...
each
...
thread
...
completes
...
its
...
step
...
and
...
then
...
calls
...
notifyAll()
...
to notify
...
the
...
waiting
...
threads.
...
The
...
thread
...
that
...
is
...
ready
...
can
...
then
...
perform
...
its
...
task,
...
while
...
all
...
the
...
threads
...
whose
...
condition
...
predicates
...
are
...
false
...
(loop
...
condition
...
expression
...
is
...
true)
...
promptly
...
resume
...
waiting.
...
Only
...
the
...
run()
...
method
...
from
...
the
...
noncompliant
...
code
...
example
...
is
...
modified,
...
as
...
follows:
| Code Block | ||||
|---|---|---|---|---|
| =
| |||
} @Override public void run() { try { synchronized (lock) { while (time != step) { lock.wait(); } // Perform operations time++; lock.notifyAll(); // Use notifyAll() instead of notify() } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } } {code} h2. Noncompliant Code Example ({{Condition}} interface) This noncompliant code example is |
Noncompliant Code Example (Condition interface)
This noncompliant code example is similar to the noncompliant code example for notify() but uses the Condition interface for waiting and notification.
| Code Block | ||
|---|---|---|
| ||
similar to the noncompliant code example for {{notify()}} but uses the {{Condition}} interface for waiting and notification. {code:bgColor=#FFcccc} public class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static final Condition condition = lock.newCondition(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } @Override public void run() { lock.lock(); try { while (time != step) { condition.await(); } // Perform operations time++; condition.signal(); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } public static void main(String[] args) { for (int i = 4; i >= 0; i--) { new Thread(new ProcessStep(i)).start(); } } } {code} As with {{ |
As with Object.notify()
...
,
...
the
...
signal()
...
method
...
may
...
awaken
...
an
...
arbitrary
...
thread.
...
Compliant Solution (signalAll()
...
)
| Wiki Markup |
|---|
This compliant solution uses the {{signalAll()}} method to notify all waiting threads. Before {{await()}} returns, the current thread reacquires the lock associated with this condition. When the thread returns, it is guaranteed to hold this lock \[[API |
...
2006|AA. Java References#API 06]\] |
...
The thread that is |
...
ready |
...
can |
...
perform its task, while all the threads whose condition predicates are false resume waiting. |
...
Only
...
the
...
run()
...
method
...
from
...
the
...
noncompliant
...
code
...
example
...
is
...
modified,
...
as
...
follows:
| Code Block | ||||
|---|---|---|---|---|
| =
| |||
} @Override public void run() { lock.lock(); try { while (time != step) { condition.await(); } // Perform operations time++; condition.signalAll(); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } {code} h2. Compliant Solution |
Compliant Solution (Unique
...
Condition
...
Per
...
Thread)
...
This
...
compliant
...
solution
...
assigns
...
each
...
thread
...
its
...
own
...
condition.
...
All
...
the
...
Condition
...
objects
...
are
...
accessible
...
to
...
all
...
the
...
threads.
| Code Block | ||||
|---|---|---|---|---|
| =
| |||
} // Declare class as final because its constructor throws an exception public final class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static int time = 0; private final int step; // Do operations when field time reaches this value private static final int MAX_STEPS = 5; private static final Condition[] conditions = new Condition[MAX_STEPS]; public ProcessStep(int step) { if (step <= MAX_STEPS) { this.step = step; conditions[step] = lock.newCondition(); } else { throw new IllegalArgumentException("Too many threads"); } } @Override public void run() { lock.lock(); try { while (time != step) { conditions[step].await(); } // Perform operations time++; if (step + 1 < conditions.length) { conditions[step + 1].signal(); } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } public static void main(String[] args) { for (int i = MAX_STEPS - 1; i >= 0; i--) { ProcessStep ps = new ProcessStep(i); new Thread(ps).start(); } } } {code} |
Even
...
though
...
the signal()
...
method is
...
used,
...
only
...
the
...
thread
...
whose
...
condition
...
predicate
...
corresponds
...
to
...
the
...
unique
...
Condition
...
variable
...
will
...
awaken.
...
This compliant solution is safe only if untrusted code cannot create a thread with an instance of this class.
Risk Assessment
Notifying a single thread instead of all waiting threads can pose a threat to the liveness property of the system.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
THI04- J | low | unlikely | medium | P2 | L3 |
References
| Wiki Markup |
|---|
\[[API 2006|AA. Java References#API 06]\] {{java.util.concurrent.locks.Condition}} interface
\[[JLS 2005|AA. Java References#JLS 05]\] [Chapter 17, Threads and Locks|http://java.sun.com/docs/books/jls/third_edition/html/memory.html]
\[[Goetz 2006|AA. Java References#Goetz 06]\] Section 14.2.4, Notification
\[[Bloch 2001|AA. Java References#Bloch 01]\] Item 50: Never invoke wait outside a loop |
...