Java: S2222 Locks should be released - ignore finally statement

[JayDi85 (Oleg Agafonov)]

Found broken false positive with java’s rule S2222: Locks should be released - Unlock this lock along all executions paths of this method.

Code example:

final Lock w = lock.writeLock();
w.lock();
try {
    clients.put(userId, userName);
} finally {
    w.unlock();
}

Full link to wrong report and code

[Michael (Michael Gumowski)]

Hello Oleg,

Thanks for the feedback. Your reproducer is not enough to trigger the FP, but this is unfortunately a known issue with our Symbolic Execution (SE) engine. SE is having trouble handling exceptional path when try-catch-finally are nested, and does not quite follow unlocking mechanism, as illustrated in the following example:

abstract class A {
  public void foo(java.util.concurrent.locks.Lock w) {
    try {
      w.lock(); // FP on w, which is necessarily unlocked in the finally.
      try {
        doSomething();
      } finally {
        w.unlock(); // <--- SE engine consider unlock() can fail
      }
    } catch (Exception e) {
      doSomething();
    }
  }

  abstract void doSomething();
}

The following ticket tracks the issue: SONARJAVA-2379

Cheers,
Michael