Thread startup can be misleading because sometimes the code appears to be performing the function correctly, when in fact it may be executing in the wrong thread. It is critical to ensure that threads are started correctly.
The Thread.start()
method starts executing a thread's run()
method in that thread. It is a mistake to directly invoke the run()
method on a Thread
object. When invoked directly, the statements in the run()
method execute in the current thread instead of the newly created thread. Furthermore, if the Thread
object is not constructed from a Runnable
object but rather by instantiating a subclass of Thread
that does not override the run()
method, a call to the subclass's run()
method invokes Thread.run()
which performs a no-operation.
Noncompliant Code Example
This noncompliant code example explicitly invokes run()
in the context of the current thread.
final class Foo implements Runnable { public void run() { // ... } public static void main(String[] args) { Foo f = new foo(); new Thread(f).run(); } }
The start()
method is not invoked on the new thread because of the incorrect assumption that run()
starts the new thread. Consequently, the statements in the run()
method execute in the same thread instead of the new one.
Compliant Solution
This compliant solution correctly uses the start()
method to start a new thread which then executes the run()
method.
final class Foo implements Runnable { public void run() { // ... } public static void main(String[] args) { Foo f = new foo(); new Thread(f).start(); } }
Exceptions
EX1: The run()
method may be invoked when unit testing its functionality. Note that a class cannot be tested for multithreaded use by invoking run()
directly.
EX2: When using a Thread
object that implements Runnable
, and requiring to execute the object's run()
method in the current thread, the object should be cast to a Runnable
before invoking run()
.
Thread thread = new Thread(new Runnable() { public void run() { // ... } }); // Invoking thread.run() is bad; the programmer probably meant thread.start() ((Runnable) t).run(); // (Admissible) Warning: This does not start a new thread
Casting a thread to a Runnable
before calling run()
serves to document the intention behind explicitly calling Thread.run()
. Adding a disclaimer alongside the invocation is highly recommended.
Risk Assessment
Failing to start threads correctly can cause unexpected behavior.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
CON05- J |
low |
probable |
medium |
P4 |
L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[API 06]] Interface Runnable
and class Thread
CON04-J. Synchronize using an internal private final lock object 11. Concurrency (CON) VOID CON06-J. Do not defer a thread that is holding a lock