Skip to content

False negative: DoubleCheckedLocking.ql cannot detect scenarios with ternary expressions. #21395

@Carlson-JLQ

Description

@Carlson-JLQ

Version
codeql 2.23.9
Description of the issue
When I detect the code like this using java/Likely Bugs/Concurrency/DoubleCheckedLocking.ql, the problem is reported normally:

public class PosCase1 {
    private Object instance; // Non-volatile field
    public Object getInstance() {
        if (instance == null) { // First null check
            synchronized (this) { // [REPORTED LINE]
                if (instance == null) { // Second null check inside synchronized block
                    instance = new Object(); // Initialization
                }
            }
        }
        return instance; // Return after double-checked locking
    }
}

However, when ternary expressions are introduced into the code, DoubleCheckedLocking.ql fails to detect the problem:

public class PosCase1_Var1 {
    private Object instance; // Non-volatile field
    public Object getInstance() {
        // Use ternary for outer check, but preserve unsafe pattern
        return (instance != null) ? instance : createInstance();
    }
    private Object createInstance() {
        synchronized (this) {
            if (instance == null) {
                instance = new Object();
            }
            return instance;
        }
    }
}

These two code snippets are semantically identical, only using a ternary expression with some transformations, which is why DoubleCheckedLocking.ql cannot detect the problem.

Metadata

Metadata

Assignees

No one assigned

    Labels

    questionFurther information is requested

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions