Synchronize overrides of synchronized methods (CodeQL java/non-sync-override)#234
Open
vharseko wants to merge 2 commits into
Open
Synchronize overrides of synchronized methods (CodeQL java/non-sync-override)#234vharseko wants to merge 2 commits into
vharseko wants to merge 2 commits into
Conversation
…verride)
Four methods overrode a synchronized method from java.io.InputStream or
java.lang.Throwable without carrying the synchronized modifier, so a caller
that relies on the base-class locking contract loses it on these subtypes.
Restore the modifier on each override:
- ByteArrayBranchingStream.mark: the class already synchronizes read/skip/
available/reset, all of which share the position/mark fields; mark mutated
mark from position without the lock, so add synchronized to match.
- Value.OldValueInputStream.mark and reset: honour the InputStream contract
for the ObjectInputStream used to decode a Value; both touch the shared
_mark / _value._next cursor.
- PersistitMap.PersistitMapException.getCause: honour the Throwable.getCause
contract.
Each method only reads or writes its own fields, so adding synchronized cannot
introduce a lock-ordering deadlock, and single-threaded callers are unaffected.
maximthomas
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Resolves all four open
java/non-sync-overrideCodeQL alerts. Each methodoverrode a
synchronizedmethod fromjava.io.InputStreamorjava.lang.Throwablebut dropped thesynchronizedmodifier, so a caller thatrelies on the base-class locking contract silently loses it on these subtypes.
The fix restores the modifier on each override.
ByteArrayBranchingStream.java(105)markInputStream.markValue.java(5059)markInputStream.markValue.java(5064)resetInputStream.resetPersistitMap.java(744)getCauseThrowable.getCauseWhy it is safe
ByteArrayBranchingStream.mark— the class already declaresread,skip,availableandresetassynchronized, and they all read/write theshared
position/markfields.markwas the one method mutatingmarkfrom
positionwithout the lock, so addingsynchronizedsimply makes itconsistent with its siblings.
Value.OldValueInputStream.mark/reset— this is theObjectInputStreamused to decode aValue; both methods touch the shared_mark/_value._nextcursor. Synchronizing restores theInputStreamcontract.
PersistitMap.PersistitMapException.getCause— restores theThrowable.getCausecontract for this unchecked wrapper.Every one of these methods only reads or writes its own instance fields and
calls nothing that takes another lock, so adding
synchronizedcannot introducea lock-ordering deadlock. Single-threaded callers see no behavioural change.
Testing
mvn -o -pl commons/http-framework/core,persistit/core -am compile— BUILD SUCCESS.