Read without ads and support Scribd by becoming a Scribd Premium Reader.
See Premium Plans
 
 Java Concurrency Guidelines
Fred LongDhruv MohindraRobert SeacordDavid Svoboda
May 2010TECHNICAL REPORT
CMU/SEI-2010-TR-015ESC-TR-2010-015
CERT
Program
Unlimited distribution subject to the copyright.http://www.cert.org/ 
 
 
This report was prepared for theSEI Administrative AgentESC/XPK5 Eglin StreetHanscom AFB, MA 01731-2100The ideas and findings in this report should not be construed as an official DoD position. It is published in theinterest of scientific and technical information exchange.This work is sponsored by the U.S. Department of Defense. The Software Engineering Institute is a federallyfunded research and development center sponsored by the U.S. Department of Defense.Copyright 2010 Carnegie Mellon University.NO WARRANTYTHIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL ISFURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OFANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITEDTO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTSOBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKEANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, ORCOPYRIGHT INFRINGEMENT.Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder.Internal use. Permission to reproduce this document and to prepare derivative works from this document forinternal use is granted, provided the copyright and “No Warranty” statements are included with all reproductionsand derivative works.External use. This document may be reproduced in its entirety, without modification, and freely distributed inwritten or electronic form without requesting formal permission. Permission is required for any other externaland/or commercial use. Requests for permission should be directed to the Software Engineering Institute atpermission@sei.cmu.edu. This work was created in the performance of Federal Government Contract Number FA8721-05-C-0003 withCarnegie Mellon University for the operation of the Software Engineering Institute, a federally funded researchand development center. The Government of the United States has a royalty-free government-purpose license touse, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so,for government purposes pursuant to the copyright license under the clause at 252.227-7013.
 
 
CMU/SEI-2010-TR-015
 
|
 
i
 
Table of Contents
Acknowledgments xi
 
About This Report xiii
 
Abstract xv
 
1
 
Introduction 1
 
1.1.1
 
The
volatile
Keyword 4
 
1.1.2
 
Synchronization 5
 
1.1.3
 
The
java.util.concurrent
Classes 6
 
2
 
Visibility and Atomicity (VNA) Guidelines 9
 
2.1
 
VNA00-J. Ensure visibility when accessing shared primitive variables 9
 
2.1.1
 
Noncompliant Code Example (Non-Volatile Flag) 9
 
2.1.2
 
Compliant Solution (
volatile
) 10
 
2.1.3
 
Compliant Solution (
java.util.concurrent.atomic.AtomicBoolean
) 10
 
2.1.4
 
Compliant Solution (
synchronized
) 11
 
2.1.5
 
Exceptions 12
 
2.1.6
 
Risk Assessment 12
 
2.1.7
 
References 12
 
2.2
 
VNA01-J. Ensure visibility of shared references to immutable objects 13
 
2.2.1
 
Noncompliant Code Example 13
 
2.2.2
 
Compliant Solution (Synchronization) 14
 
2.2.3
 
Compliant Solution (
volatile
) 14
 
2.2.4
 
Compliant Solution (
java.util.concurrent
Utilities) 15
 
2.2.5
 
Risk Assessment 15
 
2.2.6
 
References 15
 
2.3
 
VNA02-J. Ensure that compound operations on shared variables are atomic 16
 
2.3.1
 
Noncompliant Code Example (Logical Negation) 16
 
2.3.2
 
Noncompliant Code Example (Bitwise Negation) 17
 
2.3.3
 
Noncompliant Code Example (
volatile
) 17
 
2.3.4
 
Compliant Solution (Synchronization) 18
 
2.3.5
 
Compliant Solution (Volatile-Read, Synchronized-Write) 18
 
2.3.6
 
Compliant Solution (Read-Write Lock) 19
 
2.3.7
 
Compliant Solution (
AtomicBoolean
) 20
 
2.3.8
 
Noncompliant Code Example (Addition of Primitives) 20
 
2.3.9
 
Noncompliant Code Example (Addition of Atomic Integers) 21
 
2.3.10
 
Compliant Solution (Addition) 21
 
2.3.11
 
Risk Assessment 22
 
2.3.12
 
References 22
 
2.4
 
VNA03-J. Do not assume that a group of calls to independently atomic methods isatomic 23
 
2.4.1
 
Noncompliant Code Example (
AtomicReference
) 23
 
2.4.2
 
Compliant Solution (Method Synchronization) 24
 
2.4.3
 
Noncompliant Code Example (
synchronizedList
) 24
 
2.4.4
 
Compliant Solution (Synchronized Block) 25
 
2.4.5
 
Noncompliant Code Example (
synchronizedMap
) 25
 
2.4.6
 
Compliant Solution (Synchronization) 26
 
2.4.7
 
Compliant Solution (
ConcurrentHashMap
) 26
 
2.4.8
 
Risk Assessment 28
 
Search
Search History:
Searching...
Result 00 of 00
00 results for result for
  • p.

    • More From This User

    29 p.
    Spotlight On: Insider Theft of Intellectual Property Inside the Uni...
    Software Engineering Institute Publications
    7 Reads
    44 p.
    Software Assurance Competency Model
    Software Engineering Institute Publications
    21 Reads
    53 p.
    PSP-VDC: An Adaptation of the PSP that Incorporates Verified Design...
    Software Engineering Institute Publications
    51 Reads
    63 p.
    Quantifying Uncertainty in Expert Judgment: Initial Results
    Software Engineering Institute Publications
    93 Reads
    31 p.
    Justification of a Pattern for Detecting Intellectual Property Thef...
    Software Engineering Institute Publications
    145 Reads
    67 p.
    Detecting and Preventing Data Exfiltration Through Encrypted Web Se...
    Software Engineering Institute Publications
    458 Reads
    47 p.
    The MAL: A Malware Analysis Lexicon
    Software Engineering Institute Publications
    430 Reads
    30 p.
    Insider Threat Control: Understanding Data Loss Prevention (DLP) an...
    Software Engineering Institute Publications
    135 Reads
    144 p.
    12tr012
    Software Engineering Institute Publications
    135 Reads
    50 p.
    12tn025
    Software Engineering Institute Publications
    87 Reads
    46 p.
    12sr010
    Software Engineering Institute Publications
    162 Reads
    173 p.
    12sr009
    Software Engineering Institute Publications
    414 Reads
    117 p.
    12sr013
    Software Engineering Institute Publications
    244 Reads
    46 p.
    12tn024
    Software Engineering Institute Publications
    139 Reads
    100 p.
    12sr015
    Software Engineering Institute Publications
    101 Reads
    59 p.
    Supporting the Use of CERT® Secure Coding Standards in DoD Acquisit...
    Software Engineering Institute Publications
    300 Reads
    59 p.
    Resource Allocation in Dynamic Environments
    Software Engineering Institute Publications
    341 Reads
    19 p.
    Well There’s Your Problem: Isolating the Crash-Inducing Bits in a F...
    Software Engineering Institute Publications
    163 Reads
    38 p.
    The Role of Standards in Cloud-Computing Interoperability
    Software Engineering Institute Publications
    210 Reads
    25 p.
    Communication Among Incident Responders - A Study
    Software Engineering Institute Publications
    118 Reads
    41 p.
    Cloud Computing at the Tactical Edge
    Software Engineering Institute Publications
    123 Reads
    41 p.
    Towards a Theory of Assurance Case Confidence
    Software Engineering Institute Publications
    292 Reads
    114 p.
    SEPG Europe 2012 Proceedings
    Software Engineering Institute Publications
    243 Reads
    29 p.
    Competency Lifecycle Roadmap: Toward Performance Readiness
    Software Engineering Institute Publications
    92 Reads
    75 p.
    Network Profiling Using Flow
    Software Engineering Institute Publications
    823 Reads
    Notes
    Load more