Repository navigation
java/unsafe-double-checked-locking: not reported when the outer guard is written as !(!(x == null)) #22967
Description
Description of the issue
The query reports double-checked locking on a non-volatile field in Dcl.getHelper(). In DclV.getHelper() the outer guard is !(!(helper == null)) instead of helper == null, with the inner check and the field unchanged. Nothing is reported for DclV, though it's the same test.
Query: java/unsafe-double-checked-locking (codeql/java-queries 1.1.10)
CodeQL CLI: 2.27.2
Code samples
seed/Dcl.java:
class Dcl {
private Helper helper;
Helper getHelper() {
if (helper == null) { // query fires here
synchronized (this) {
if (helper == null) {
helper = new Helper();
}
}
}
return helper;
}
static class Helper {
int x;
}
}variant/DclV.java:
class DclV {
private Helper helper;
Helper getHelper() {
if (!(!(helper == null))) { // equivalent outer guard; query silent
synchronized (this) {
if (helper == null) {
helper = new Helper();
}
}
}
return helper;
}
static class Helper {
int x;
}
}How to reproduce
codeql database create db --language=java --build-mode=none \
--source-root=<one directory> --overwrite
codeql database analyze db \
codeql/java-queries:codeql-suites/java-security-and-quality.qls \
--format=csv --output=out.csv
# one database per directory
Expected result
"Double-checked locking on the non-volatile field helper is not thread-safe" on DclV, as on Dcl.
Output of the commands above:
### CodeQL 2.27.2 query: java/unsafe-double-checked-locking
### suite: java-security-and-quality.qls, --build-mode=none, per-file isolated databases
### extraction JDK: openjdk version "21.0.11" 2026-04-21 LTS
--- SEED -- expected: query fires (seed/)
"Double-checked locking is not thread-safe","A repeated check on a non-volatile field is not thread-safe, and
--- VARIANT -- expected: query fires, actual: not reported (the bug) (variant/)
(query reported nothing)
Activity
sam-robson commentedon Nov 3, 2026
Hi @MarkLee131, thanks for the detailed report. We'll take a look into this and follow up.
sam-robson commentedon Nov 4, 2026
The
java/unsafe-double-checked-lockingquery matches the standard double-checked locking idiom syntactically, so it only checks for direct== nullequality tests rather than evaluating arbitrary boolean expressions such as!(!(x == null)).