Difference between revisions of "Code Correctness: Double-Checked Locking"

Revision as of 16:47, 19 July 2006

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.

This article includes content generously donated to OWASP by

Abstract

Double-checked locking is an incorrect idiom that does not achieve the intended effect.

Description

Many talented individuals have spent a great deal of time pondering ways to make double-checked locking work in order to improve performance. None have succeeded.

Examples

At first blush it may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization.

	if (fitz == null) {
	  synchronized (this) {
		if (fitz == null) {
		  fitz = new Fitzer();
		}
	  }
	}
	return fitz;

The programmer wants to guarantee that only one Fitzer() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called. This idiom is known as double-checked locking.

Unfortunately, it does not work, and multiple Fitzer() objects can be allocated. See The "Double-Checked Locking is Broken" Declaration for more details [1].

Related Threats

Related Attacks

Related Vulnerabilities

Related Countermeasures

References

[1] D. Bacon et al. The "Double-Checked Locking is Broken" Declaration. http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html.

Categories