Page History

Static shared data should not be protected using instance locks because the Programs must not use instance locks to protect static shared data because instance locks are ineffective when two or more instances of the class are created. Consequently, failure to use a static lock object leaves the shared state is not safe for unprotected against concurrent access. Lock objects for classes that can interact with untrusted code must also be private and final, as shown in LCK00-J. Use private final lock objects to synchronize classes that may interact with untrusted code.

Noncompliant Code Example (

...

Nonstatic Lock Object for Static Data)

This noncompliant code example uses a non-static lock object attempts to guard access to a the static counter field counter. If using a nonstatic lock object. When two Runnable tasks , each consisting of a thread are started, they will create two instances of the lock object and lock on each instance separately.

public final class CountBoxes implements Runnable {
  private static volatile int counter;
  // ...

  private final Object lock = new Object();    

  @Override public void run() {
    synchronized (lock) {
      counter++; 
      // ... 
    } 
  }

  public static void main(String[] args) {
    Runnable r1for (int i = new CountBoxes();
    Thread t1 = new Thread(r1);
    Runnable r2 = 0; i < 2; i++) {
    new Thread(new CountBoxes();
    Thread t2 = new Thread(r2);
    t1.start();
    t2.start();}
  }
}

This does not example fails to prevent either thread from observing an inconsistent value of counter because the increment operation on volatile fields is not fails to be atomic in the absence of proper synchronization (see VNA02-J. Ensure that compound operations on shared variables are atomic for more information).

Noncompliant Code Example (

...

Method Synchronization for Static Data)

This noncompliant code example uses method synchronization to protect access to a static class counter field counter. :

public final class CountBoxes implements Runnable {
  private static volatile int counter;
  // ...

  public synchronized void run() {
      counter++; 
      // ... 
  }
  // ...
}

The problem is that this lock is In this case, the method synchronization uses the intrinsic lock associated with each instance of the class and not rather than the intrinsic lock associated with the class object itself. Consequently, threads constructed using different Runnable instances may observe inconsistent values of the counter.

Compliant Solution (

...

Static Lock Object)

This compliant solution declares the lock object as static and consequently, ensures the atomicity of the increment operation .by locking on a static object:

public class CountBoxes implements Runnable {
  private static int counter;
  // ...

  private static final Object lock = new Object();    
  
  public void run() {
    synchronized (lock) {
      counter++; 
      // ...
    }
  }
  // ...
}

There is no requirement of declaring It is unnecessary to declare the counter variable as volatile when using synchronization is used.

Risk Assessment

Using an instance lock to protect static shared data provides no synchronization properties and can lead to non-deterministic can result in nondeterministic behavior.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[API 06|AA. Java References#API 06]\] 

Some static analysis tools can detect violations of this rule.

Related Guidelines

Bibliography

Issue Tracking

 
||Completed||Priority||Locked||CreatedDate||CompletedDate||Assignee||Name|| 
|T|M|F|1270215165305|1271447005294|rcs_mgr|"Ideally, the lock should also be private and final" => I have been penalized for using "ideally" before. I would just remove that sentence or make it more definitive. Note that we also have an NCE that uses method synchronization. Perhaps we also need a CS with a static method.| 

...

Image Added Image Added Image AddedVOID CON00-J. Synchronize access to shared mutable variables      11. Concurrency (CON)      CON03-J. Do not use background threads during class initialization