...
Threads that invoke Object.wait()
...
expect to
...
wake
...
up
...
and
...
resume
...
execution
...
when
...
their condition predicate becomes true. To be compliant with THI03-J.
...
...
...
...
...
...
...
...
...
...
,
...
waiting
...
threads
...
must test
...
their
...
condition
...
predicates
...
upon
...
receiving
...
notifications
...
and
...
must resume
...
waiting
...
if
...
the predicates are
...
false
...
.
The notify()
and notifyAll()
methods of package java.lang.Object
...
are
...
used
...
to
...
wake
...
up
...
a waiting thread or threads, respectively. These methods must be invoked from a thread that holds the same object lock as the waiting thread(s); these methods throw an IllegalMonitorStateException
when invoked from any other thread. The notifyAll()
method wakes up all threads waiting on an object lock and allows threads whose condition predicate is true to resume execution. Furthermore, if all the threads whose condition predicate evaluates to true previously held a specific lock before going into the wait state, only one of them will reacquire the lock upon being notified. Presumably, the other threads will resume waiting. The notify()
method wakes up only one thread, with no guarantee regarding which specific thread is notified. The chosen thread is permitted to resume waiting if its condition predicate is unsatisfied; this often defeats the purpose of the notification.
Consequently, invoking the notify()
method is permitted only when all of the following conditions are met:
- All waiting threads have identical condition predicates.
- All threads perform the same set of operations after waking up. That is, any one thread can be selected to wake up and resume for a single invocation of
notify()
. - Only one thread is required to wake upon the notification.
These conditions are satisfied by threads that are identical and provide a stateless service or utility.
The java.util.concurrent.locks
utilities provide the Condition.signal()
and Condition.signalAll()
methods to awaken threads that are blocked on a Condition.await()
call. Condition
objects are required when using java.util.concurrent.locks.Lock
objects. Although Lock
objects allow the use of Object.wait()
, Object.notify()
, and Object.notifyAll()
methods, their use is prohibited by LCK03-J. Do not synchronize on the intrinsic locks of high-level concurrency objects. Code that synchronizes using a Lock
object uses one or more Condition
objects associated with the Lock
object rather than using its own intrinsic lock. These objects interact directly with the locking policy enforced by the Lock
object. Consequently, the await()
, signal()
, and signalAll()
methods are used in place of the wait()
, notify()
, and notifyAll()
methods.
The signal()
method must not be used unless all of these conditions are met:
- The
Condition
object is identical for each waiting thread. - All threads must perform the same set of operations after waking up, which means that any one thread can be selected to wake up and resume for a single invocation of
signal()
. - Only one thread is required to wake upon receiving the signal.
or all of these conditions are met:
- Each thread uses a unique
Condition
object. - Each
Condition
object is associated with the sameLock
object.
When used securely, the signal()
method has better performance than signalAll()
.
When notify()
or signal()
is used to waken a waiting thread, and the thread is not prepared to resume execution, it often resumes waiting. Consequently, no thread wakens, which may cause the system to hang.
Noncompliant Code Example (notify()
)
This noncompliant code example shows a complex, multistep process being undertaken by several threads. Each thread executes the step identified by the time
field. Each thread waits for the time
field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread first increments time
and then notifies the thread that is responsible for the next step.
Code Block | ||
---|---|---|
| ||
public final class ProcessStep implements Runnable {
private static final Object lock = new Object();
private static int time = 0;
private final int step; // Do Perform operations when field time
// reaches this value
public ProcessStep(int step) {
this.step = step;
}
@Override public void run() {
try {
synchronized (lock) {
while (time != step) {
lock.wait();
}
// Perform operations
time++;
lock.notify();
}
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
}
}
public static void main(String[] args) {
for (int i = 4; i >= 0; i--) {
new Thread(new ProcessStep(i)).start();
}
}
}
|
This noncompliant code example violates the liveness property. Each thread has a different condition predicate because each requires step
to have a different value before proceeding. The Object.notify()
method wakes only one thread at a time. Unless it happens to wake the thread that is required to perform the next step, the program will deadlock.
Compliant Solution (notifyAll()
)
In this compliant solution, each thread completes its step and then calls notifyAll()
to notify the waiting threads. The thread that is ready can then perform its task while all the threads whose condition predicates are false (loop condition expression is true) promptly resume waiting.
Only the run()
method from the noncompliant code example is modified, as follows:
Code Block | ||
---|---|---|
| ||
public final class ProcessStep implements Runnable {
private static final Object lock = new Object();
private static int time = 0;
private final int step; // Perform operations when field time
// reaches this value
public ProcessStep(int step) {
this.step = step;
}
@Override public void run() {
try {
synchronized (lock) {
while (time != step) {
lock.wait();
}
// Perform operations
time++;
lock.notifyAll(); // Use notifyAll() instead of notify()
}
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
}
}
}
|
Noncompliant Code Example (Condition
Interface)
This noncompliant code example is similar to the noncompliant code example for notify()
but uses the Condition
interface for waiting and notification:
Code Block | ||
---|---|---|
| ||
public class ProcessStep implements Runnable {
private static final Lock lock = new ReentrantLock();
private static final Condition condition = lock.newCondition();
private static int time = 0;
private final int step; // Perform operations when field time
// reaches this value
public ProcessStep(int step) {
this.step = step;
}
@Override public void run() {
lock.lock();
try {
while (time != step) {
condition.await();
}
// Perform operations
time++;
condition.signal();
} catch (InterruptedException ie) {
Thread.currentThread().interrupt(); // Reset interrupted status
} finally {
lock.unlock();
}
}
public static void main(String[] args) {
for (int i = 4; i >= 0; i--) {
new Thread(new ProcessStep(i)).start();
}
}
}
|
As with Object.notify()
, the signal()
method may awaken an arbitrary thread.
Compliant Solution (signalAll()
)
This compliant solution uses the signalAll()
method to notify all waiting threads. Before await()
returns, the current thread reacquires the lock associated with this condition. When the thread returns, it is guaranteed to hold this lock [API 2014]. The thread that is ready can perform its task while all the threads whose condition predicates are false resume waiting.
Only the run()
method from the noncompliant code example is modified, as follows:
Code Block | ||
---|---|---|
| ||
public class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static final Condition condition = lock.newCondition(); private static int time = 0; private final int step; // Perform operations when field time // reaches this value public ProcessStep(int step) { this.step = step; } @Override thread(s). These methods must be invoked from code that holds the same object lock as the waiting thread(s). The {{notifyAll()}} method wakes up all threads and allows threads whose condition predicate is true to resume execution. Furthermore, if all the threads whose condition predicate evaluates to true previously held a specific lock before going into the wait state, only one of them will reacquire the lock upon being notified. Presumably, the others will resume waiting. The {{notify()}} method wakes up only one thread and makes no guarantees as to which thread is notified. If the thread's condition predicate doesn't allow the thread to proceed, the chosen thread may resume waiting, defeating the purpose of the notification. The {{notify()}} method may only be invoked if all the following conditions are met: * Every condition predicate in every waiting thread would be true (condition expressions in loops will be false) if a notification were received by each, independently. Furthermore, all these threads must perform the same set of operations after waking up. In other words, any one thread can be selected to wake up and resume for a single invocation of {{notify()}}. * Only one thread is required to wake up on the notify signal. This is contingent on the condition predicate, in that, only one predicate must fulfill the condition and allow the thread to proceed. Multiple condition predicates in the same statement should be avoided. * No untrusted code has access to the object being waited on. If untrusted code has access to this object, it can invoke {{wait()}} on the object and intercept a {{notify()}} call. The {{java.util.concurrent}} utilities (interface {{Condition}}) provide the {{signal()}} and {{signalAll()}} methods to awaken threads that are blocked on an {{await()}} call. Much like the {{notify()}} method, the {{signal()}} method wakes up only one of the threads that is waiting on the condition and consequently, may be insecure. It is always safer to use {{signalAll()}}. {mc} IMHO this stuff is related, but not necessary ~DS albeit a small performance penalty. Similarly, if any thread is blocked on a {{wait()}} method invocation on a Java object which is being used as a condition queue, then that thread should be notified using {{notifyAll()}}. CON39-J. Do not synchronize on the intrinsic locks of high-level concurrency objects {mc} h2. Noncompliant Code Example ({{notify()}}) This noncompliant code example shows a complex multi-step process being undertaken by several threads. Each thread executes one step of the process; the step being currently performed is indicated by the {{step}} field. Each thread waits for the {{step}} field to indicate that it is time to perform the corresponding thread's step. After performing the step, each thread increments {{step}} to transfer control to the next thread. The thread then notifies the thread that is responsible for the next step, and then the first thread exits. {code:bgColor=#FFcccc} public final class ProcessStep implements Runnable { private static final Object lock = new Object(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } public void run() { try { synchronized (lock) { while (time != step) { lock.wait(); } // ... Do operations time++; lock.notify(); } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } } public static void main(String[] args) { for (int i = 4; i >= 0; i--) { new Thread(new ProcessStep(i)).start(); } } } {code} This noncompliant code example violates the [liveness|BB. Definitions#liveness] property. Each thread has a different condition predicate, as each requires {{step}} to have a different value before proceeding. The {{Object.notify()}} method wakes up only one thread at a time. Unless it happens to wake up the thread that is required to perform the next step, the program will deadlock and fail to make any progress. h2. Compliant Solution ({{notifyAll()}}) In this compliant solution, all threads that have performed their own step use {{notifyAll()}} to notify other waiting threads. Consequently, the thread that is ready can perform its task, while all other threads whose condition predicates are false (loop condition expression is true), promptly resume waiting. {code:bgColor=#ccccff} // ... public void run() { try { synchronized (lock) { while (time != step) { lock.wait(); } // ... Do operations time++; lock.notifyAll(); } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } } {code} h2. Noncompliant Code Example ({{Condition}} interface) This noncompliant code example derives from the previous noncompliant code example but uses the {{Condition}} interface. The {{condition}} field allows the threads to wait on different condition predicates. {code:bgColor=#FFcccc} public class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static final Condition condition = lock.newCondition(); private static int time = 0; private final int step; // Do operations when field time reaches this value public ProcessStep(int step) { this.step = step; } public void run() { lock.lock(); try { while (time != step) { condition.await(); } // ... Do operations time++; condition.signal(); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } public static void main(String[] args) { for (int i = 4; i >= 0; i--) { new Thread(new ProcessStep(i)).start(); } } } {code} Similar to {{Object.notify()}}, the {{signal()}} method may choose any one thread and awaken it. h2. Compliant Solution ({{signalAll()}}) This compliant solution uses the {{signalAll()}} method to resume all the waiting threads whose condition predicate allows doing so. {code:bgColor=#ccccff} // ... public void run() { lock.lock(); try { while (time != step) { condition.await(); } // ... DoPerform operations time++; condition.signalAll(); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } {code} h2. |
Compliant
...
Solution
...
(
...
Unique Condition
...
per
...
Thread)
...
This
...
compliant
...
solution
...
assigns
...
each
...
thread
...
its
...
own condition. All the Condition
objects are accessible to all the threads:
Code Block | ||
---|---|---|
| ||
condition, and makes all the {{Condition}} objects accessible to all the threads. {code:bgColor=#ccccff} // Declare class as final because its constructor throws an exception public final class ProcessStep implements Runnable { private static final Lock lock = new ReentrantLock(); private static int time = 0; private final int step; // DoPerform operations when field time reaches this value private static final int MAX_STEPS = 5; private static final Condition[] conditions = new Condition[ // reaches this value private static final int MAX_STEPS = 5; private static final Condition[] conditions = new Condition[MAX_STEPS]; public ProcessStep(int step) { if (step <= MAX_STEPS) { this.step = step; conditions[step] = lock.newCondition(); } else { throw new IllegalArgumentException("Too many threads"); } } @Override public void run() { lock.lock(); try { while (time != step) { conditions[step].await(); } // ...Perform Do operations time++; if (step + 1 < conditions.length) { conditions[step + 1].signal(); } } catch (InterruptedException ie) { Thread.currentThread().interrupt(); // Reset interrupted status } finally { lock.unlock(); } } public static void main(String[] args) { for (int i = MAX_STEPS - 1; i >= 0; i--) { ProcessStep msps = new ProcessStep(i); new Thread(msps).start(); } } } {code} |
Even
...
though
...
the signal()
...
method is
...
used,
...
only the thread whose condition predicate corresponds to the unique Condition
variable will awaken.
This compliant solution is safe only when untrusted code cannot create a thread with an instance of this class.
Risk Assessment
Notifying a single thread rather than all waiting threads can violate the liveness property of the system.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
THI02-J | Low | Unlikely | Medium | P2 | L3 |
Automated Detection
Tool | Version | Checker | Description | ||||||
---|---|---|---|---|---|---|---|---|---|
Parasoft Jtest |
| CERT.THI02.ANF | Do not use 'notify()'; use 'notifyAll()' instead so that all waiting threads will be notified | ||||||
SonarQube |
| S2446 | "notifyAll" should be used |
Related Guidelines
Bibliography
...