Starting and using background threads during class initialization can result in class initialization cycles and eventually, deadlock. This is because the main thread responsible for performing class initialization may block waiting for the background thread, which in turn will wait for the main thread to finish class initialization. This issue can arise, for example, when a database connection is established in a background thread while class initialization is in progress. \[[Bloch 05b|AA. Java References#Bloch 05b]\] |
This noncompliant code example begins initializing the class {{Lazy}}. The code in the {{static}} block is responsible for initialization and starts a background thread which is in a different (anonymous) class. The anonymous class attempts to assign to the {{initialized}} field but has to wait before initialization of the {{Lazy}} class has finished. However, the {{Lazy}} class's main thread invokes the {{join()}} method which waits for the background thread to finish. This interdependency causes a class initialization cycle that results in a deadlock situation. \[[Bloch 05b|AA. Java References#Bloch 05b]\] |
public class Lazy { private static volatile boolean initialized = false; static { Thread t = new Thread(new Runnable() { public void run() { // Initialize, for example, a database connection initialized = true; } ); t.start(); try { t.join(); } catch(InterruptedException ie) { throw new AssertionError(ie); } // Other initialization } public static void main(String[] args) { System.out.println(initialized); } } |
static
initializer)This compliant solution does not spawn a background thread during class initialization and uses a static
initializer.
public class Lazy { private static volatile boolean initialized = false; static { // Initialize, for example, a database connection initialized = true; } public static void main(String[] args) { System.out.println(initialized); } } |
ThreadLocal
)This compliant solution uses a ThreadLocal
object to initialize a database connection and sets the initialized
flag to true
depending on whether the initialization succeeds.
public class Lazy { private static volatile boolean initialized = false; private static ThreadLocal<Connection> connectionHolder = new ThreadLocal<Connection>() { public Connection initialValue() { try { Connection conn = DriverManager.getConnection("connectionstring"); initialized = true; return conn; } catch (SQLException e) { return null; } } }; public static Connection getConnection() { return connectionHolder.get(); } public static void main(String[] args) { Connection conn = getConnection(); System.out.println(initialized); } } |
Starting and using background threads during class initialization can result in deadlock conditions.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
CON03- J |
low |
likely |
high |
P3 |
L3 |
TODO
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
\[[Bloch 05b|AA. Java References#Bloch 05b]\] 8. "Lazy Initialization" |
CON02-J. Always synchronize on the appropriate object 11. Concurrency (CON) CON04-J. Use the private lock object idiom instead of a class's intrinsic locking mechanism