We've started running our code through Fortify, and as an exercise I wanted to see if Sonarqube would pick up any of the same issues.
One of the first ones I'm unable to replicate is S2168:Double-Checked Locking
The guilty code fragment:
if (instance == null)
{
// thread safe singleton
synchronized (ESSingletonClient.class)
{
if (instance == null) // doubly check
{
...stuff
}
}
}
I was running this on the default quality profile, Sonar Way, which appears to have this in its list. For grins I created a new profile based off "Sonar Way", and then added everything from "Findbugs Security Audit", but that's not finding the code segment, either.
Any thoughts on what I may be missing?
clean install: - Docker: sonarqube:alpine (7.0)
UPDATE (4/11/18):
I created a simple class with only 2 methods. They're identical to the original code, except one uses the volatile and the other doesn't. I ran it through SQ, and neither method is flagged for a double check. - SonarJava: 5.2 (build 13398)
UPDATE (4/12/18):
Added assignment to variables, calling another method, as is done in our original code. Still not being flagged.
/** volatile instance. */
private static volatile Integer v_instance = null;
/** non-volatile instance. */
private static Integer n_instance = null;
public static void getVolatileInstance()
{
if (v_instance == null)
{
// thread safe singleton
synchronized (DoubleCheck.class)
{
if (v_instance == null) // doubly check
{
assignVolatile(5);
}
}
}
}
public static void getNonVolatileInstance()
{
if (n_instance == null)
{
// thread safe singleton
synchronized (DoubleCheck.class)
{
if (n_instance == null) // doubly check
{
assignNonVolatile(6);
}
}
}
}
public static void assignVolatile(Integer value)
{
v_instance = value;
}
public static void assignNonVolatile(Integer value)
{
n_instance = value;
}
