DCL00-J. Prevent class initialization cycles

According to the Java Language Specification (JLS), §12.4, "Initialization of Classes and Interfaces" [[JLS 2005]]:

Initialization of a class consists of executing its static initializers and the initializers for static fields (class variables) declared in the class.

Therefore, the presence of a static field triggers the initialization of a class. However, a static field could depend on the initialization of another class, possibly creating an initialization cycle. The JLS also states in §8.3.2.1, "Initializers for Class Variables" [[JLS 2005]]

At run time, static variables that are final and that are initialized with compile-time constant values are initialized first.

This statement can be misleading because it is inapplicable to instances that use values of static final fields that are initialized at a later stage. Declaring a field to be static final is insufficient to guarantee that it is fully initialized before being read.

Programs in general should — and security-sensitive programs must — eliminate all class initialization cycles.

Noncompliant Code Example (Intra-class Cycle)

This noncompliant code example contains an intra-class initialization cycle.

public class Cycle {
  private final int balance;
  private static final Cycle c = new Cycle();
  private static final int deposit = (int) (Math.random() * 100); // Random deposit

  public Cycle() {
    balance = deposit - 10; // Subtract processing fee
  }

  public static void main(String[] args) {
    System.out.println("The account balance is: " + c.balance);
  }
}

The Cycle class declares a private static final class variable which is initialized to a new instance of the Cycle class. Static initializers are guaranteed to be invoked once before the first use of a static class member or the first invocation of a constructor.

The programmer's intent is to calculate the account balance by subtracting the processing fee from the deposited amount. However, the initialization of the c class variable happens before the deposit field is initialized because it appears lexically before the initialization of the deposit field. Consequently, the value of deposit seen by the constructor, when invoked during the static initialization of c, is the initial value of deposit (0) rather than the random value. As a result, the balance is always computed to be -10.

The JLS permits implementations to ignore the possibility of such recursive initialization cycles [[Bloch 2005]].

Compliant Solution (Intra-class Cycle)

This compliant solution changes the initialization order of the class Cycle so that the fields are initialized without creating any dependency cycles. Specifically, the initialization of c is placed lexically after the initialization of deposit so that it occurs temporally after deposit is fully initialized.

public class Cycle {
  private final int balance;
  private static final int deposit = (int) (Math.random() * 100); // Random deposit
  private static final Cycle c = new Cycle();  // Inserted after initialization of required fields
  public Cycle() {
    balance = deposit - 10; // Subtract processing fee
  }

  public static void main(String[] args) {
    System.out.println("The account balance is: " + c.balance);
  }
}

Such initialization cycles become insidious when many fields are involved. Consequently, it is important to ensure that the control flow lacks such cycles.

Although this compliant solution prevents the initialization cycle, it depends on declaration order and is consequently fragile; later maintainers of the software may be unaware that the declaration order must be maintained to preserve correctness. Consequently, such dependencies must be clearly documented in the code.

Noncompliant Code Example (Inter-class Cycle)

This noncompliant code example declares two classes with static variables whose values depend on each other. The cycle is obvious when the classes are seen together (as here) but is easy to miss when viewing the classes separately.

class A {
  public static final int a = B.b + 1;
  // ...
}

class B {
  public static final int b = A.a + 1;
  // ...
}

The initialization order of the classes can vary and, consequently, cause computation of different values for A.a and B.b. When class A is initialized first, A.a will have the value 2, and B.b will have the value 1. These values will be reversed when class B is initialized first.

Compliant Solution (Inter-class Cycle)

This compliant solution breaks the interclass cycle by eliminating one of the dependencies.

class A {
  public static final int a = 2;
  // ...
}

// class B unchanged: b = A.a + 1

With the cycle broken, the initial values will always be A.a = 2 and B.b = 3, regardless of initialization order.

Risk Assessment

Initialization cycles may lead to unexpected results.

Related Guidelines

Bibliography

01. Declarations and Initialization (DCL)      01. Declarations and Initialization (DCL)