JAVA.CONCURRENCY.SYNC.MSS : Missing synchronized Statement (Java)

Summary

A synchronized statement is needed to access a field.

Programmers often forget about the consistent use of synchronization statements, which results in fields being accessed without the required lock being held. This checker identifies such situations, even without any explicit annotation by the programmer.

The analyzer uses a statistical approach: if most accesses to a particular field are synchronized then it is likely that all accesses are intended to be synchronized, so a warning will be issued if there is an unsynchronized access to that field.

Java uses synchronized statements and methods to guarantee that data is accessed in a sequential way and avoid race conditions in multithreaded applications. Incorrect uses of synchronization result in unexpected behaviors and subtle bugs, very hard to identify and reproduce.

Checks for this warning class make use of annotations @com.juliasoft.julia.checkers.guardedBy.GuardedBy and @com.juliasoft.julia.checkers.guardedBy.Holding. Add these annotations to your code to identify synchronization requirements for CodeSonar to check.

The @GuardedBy annotation for fields and parameters and the @Holding annotation for methods and constructors accept a string argument, according to the following syntax.

• @GuardedBy/@Holding("this"): the lock on the receiver of a non-static field or method must be held
• @GuardedBy("itself"): the lock on the same parameter or field must be held
• @GuardedBy/@Holding("field-name"): the lock on the named field of the receiver of a non-static field or method must be held
• @GuardedBy/@Holding("Class.field-name"): the lock on the named static field of the named class must be held
• @GuardedBy/@Holding("Class.class"): the lock of the unique class object representing the class named Class must be held
• @GuardedBy/@Holding("foo()"): the lock on the return value of the named instance method called on the receiver of a non-static field or method must be held. Method foo must return a reference type
• @GuardedBy/@Holding("Class.foo()"): the lock on the return value of the named static method of the named class must be held. Method foo must return a reference type.

Properties

WARNING_FILTER += allow class="Missing synchronized Statement (Java)"

Example

import java.util.HashSet;
import java.util.Set;

public class UserRegistry {
  private final Set<String> users = new HashSet<String>();

  public void register(String user) {
    synchronized (users) {
      users.add(user);
    }
  }

  public void unregister(String user) {
    synchronized (users) {
      users.remove(user);
    }
  }

  public boolean isRegistered(String user) {
    return users.contains(user); // "Missing synchronized Statement (Java)" warning issued here
  }

  public int countUsers() {
    synchronized (users) {
      return users.size();
    }
  }
}

In this case, the programmer should add a synchronization on the access to field users inside method isRegistered() as well. We recall that hashsets are not synchronized in Java and concurrent access to the same hashset might result in inconsistent behaviors or even deadlock. Another solution, here, would be to use a synchronized or concurrent set, by exploiting the classes already available in the standard Java library. In that case, no synchronized statement would be needed anymore.

Resolution

Verify if the missing synchronization should actually be there. Annotate fields and methods with the lock that must be held when they are accessed or called, by using the @GuardedBy and @Holding annotations. If this checker does not accept those annotations, it is likely the case that your program has a synchronization problem.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

• JAVA_ANALYSIS_CONCURRENCY_CALLS
• JAVA_ANALYSIS_CONCURRENCY_GUARDS_MODE
• JAVA_ANALYSIS_DEEP_NULLNESS_CONSERVATIVE_CHECK
• JAVA_ANALYSIS_FAST_DEEP_CHECK
• JAVA_ANALYSIS_FIELD_SENSITIVE
• JAVA_ANALYSIS_INITIALIZATION_CHECK
• JAVA_ANALYSIS_MERGE_CREATION_POINTS
• REPORT_SIMILAR_WARNINGS
• WARNING_FILTER