Thread startup can be misleading because sometimes the code appears can appear to be performing the its function correctly , when in fact it may be executing in it is actually being executed by the wrong thread. It is critical to ensure that threads are started correctly.
The Invoking the Thread.start()
method starts executing a instructs the Java runtime to start executing the thread's run()
method in that using the started thread. It is a mistake to directly invoke the Invoking a Thread
object's run()
method on directly is incorrect. When a Thread
object. When 's run()
method is invoked directly, the statements in the run()
method execute in are executed by the current thread instead of rather than by the newly created thread. Furthermore, if the Thread
object is not constructed from a Runnable
object but rather was constructed by instantiating a subclass of Thread
that does not fails to override the run()
method , then a call rather than constructed from a Runnable
object, any calls to the subclass's run()
method invokes would invoke Thread.run()
which performs a no-operation, which does nothing. Consequently, programs must not directly invoke a Thread
object's run()
method.
Noncompliant Code Example
This noncompliant code example explicitly invokes run()
in the context of the current thread. :
Code Block | ||
---|---|---|
| ||
public final class Foo implements Runnable { @Override public void run() { // ... } public static void main(String[] args) { Foo ffoo = new fooFoo(); new Thread(ffoo).run(); } } |
The start()
method is not invoked on the new thread newly created thread is never started because of the incorrect assumption that run()
starts the new thread. Consequently, the statements in the run()
method execute in the same thread instead of the new oneare executed by the current thread rather than by the new thread.
Compliant Solution
This compliant solution correctly uses the start()
method to tell the Java runtime to start a new thread. The start()
method internally invokes the run()
method in the new thread.:
Code Block | ||
---|---|---|
| ||
public final class Foo implements Runnable { @Override public void run() { // ... } public static void main(String[] args) { Foo ffoo = new fooFoo(); new Thread(ffoo).start(); } } |
Exceptions
EX1THI00-J-EX0: The run()
method may be directly invoked when during unit testing its functionality. Note that this method cannot be used to test a class cannot be tested for multithreaded use by invoking run()
directly.
EX2: When using Given a Thread
object that implements Runnable
, and requiring to execute the object's was constructed with a runnable argument, when invoking the Thread.run()
method in the current thread, the Thread
object should may be cast to a Runnable
before invoking run()
. Runnable
to eliminate analyzer diagnostics:
Code Block | ||
---|---|---|
| ||
public void sampleRunTest() { Thread thread = new Thread(new Runnable() { @Override public void run() { // ... } }); // Invoking thread.run() is bad}); the programmer probably meant thread.start() ((Runnable) tthread).run(); // (Admissible) WarningTHI00-J-EX0: This doesDoes not start a new thread } |
Casting a thread to a Runnable
before calling the run()
serves to document the intention of explicitly calling method documents that the explicit call to Thread.run()
is intentional. Adding a disclaimer an explanatory comment alongside the invocation is highly recommended.
THI00-J-EX1: Runtime system code involved in starting new threads is permitted to invoke a Thread
object's run()
method directly; this is an obvious necessity for a working Java runtime system. Note that the likelihood that this exception applies to user-written code is vanishingly small.
Risk Assessment
Failing Failure to start threads correctly can cause unexpected behavior.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|
THI00-J |
Low |
Probable |
Medium | P4 | L3 |
Automated Detection
...
Automated detection of direct invocations of Thread.run()
methods is straightforward. Sound automated determination of which specific invocations are permitted may be infeasible. Heuristic approaches may be useful.
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
CodeSonar |
| JAVA.CONCURRENCY.LOCK.SCTB | Synchronous Call to Thread Body (Java) | ||||||
Coverity | 7.5 | DC.THREADING.thread_run | Implemented | ||||||
Parasoft Jtest |
| CERT.THI00.IRUN | Do not call the 'run()' method directly on classes extending 'java.lang.Thread' or implementing 'java.lang.Runnable' | ||||||
PVS-Studio |
| V6064 | |||||||
SonarQube |
| S1217 | Thread.run() should not be called directly |
Related Guidelines
Android Implementation Details
Android provides a couple of solutions for threading. The Android Developers Blog's article "Painless Threading" discusses those solutions.
Bibliography
...
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
Wiki Markup |
---|
\[[API 06|AA. Java References#API 06]\] Interface {{Runnable}} and class {{Thread}} |
CON04-J. Synchronize using an internal private final lock object 11. Concurrency (CON) VOID CON06-J. Do not defer a thread that is holding a lock