Version 4.8.4 false positive SING_SINGLETON_GETTER_NOT_SYNCHRONIZED

[garydgregory]

Spotbugs thinks there is a getter mehod to synchronize when there is none and raises a SING_SINGLETON_GETTER_NOT_SYNCHRONIZED.
To reproduce:

git clone https://gitbox.apache.org/repos/asf/commons-text.git
cd commons-text
git checkout 70436ca75ed10dd72269d4218a0cb844276d0ba9
mvn clean verify spotbugs:check -Dcommons.spotbugs.impl.version=4.8.4 -DskipTests

Will cause 10 errors when 4.8.3 raises none, including:

[ERROR] Medium: Class (org.apache.commons.text.similarity.IntersectionSimilarity$BagCount) using singleton design pattern has non-private constructor. [org.apache.commons.text.similarity.IntersectionSimilarity$BagCount] At IntersectionSimilarity.java:[line 43] SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR

On https://spotbugs.readthedocs.io/en/latest/bugDescriptions.html, SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR says:

SING: Instance-getter method of class using singleton design pattern is not synchronized. (SING_SINGLETON_GETTER_NOT_SYNCHRONIZED)[](https://spotbugs.readthedocs.io/en/latest/bugDescriptions.html#sing-instance-getter-method-of-class-using-singleton-design-pattern-is-not-synchronized-sing-singleton-getter-not-synchronized)

Instance-getter method of class using singleton design pattern is not synchronized. When this method is invoked by two or more threads simultaneously, multiple instantiation of a singleton class becomes possible.

[SEI CERT MSC07-J](https://wiki.sei.cmu.edu/confluence/display/java/MSC07-J.+Prevent+multiple+instantiations+of+singleton+objects) rule

Which sure seems like silly since there is such method.

Please advise...
TY!

[JuditKnoll]

I taken a look at the results.
Most of them (including the mentioned one) seems to be FPs, which will be solved by #2951 once it's merged (or is already solved by #2943 on master). I'm sorry for the inconvience.
I only found two true positives:

[ERROR] Medium: Class (org.apache.commons.text.similarity.LevenshteinDetailedDistance) using singleton design pattern has non-private constructor. [org.apache.commons.text.similarity.LevenshteinDetailedDistance] At LevenshteinDetailedDistance.java:[lines 457-458] SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR

[ERROR] Medium: Class (org.apache.commons.text.similarity.LevenshteinDistance) using singleton design pattern has non-private constructor. [org.apache.commons.text.similarity.LevenshteinDistance] At LevenshteinDistance.java:[lines 332-333] SING_SINGLETON_HAS_NONPRIVATE_CONSTRUCTOR

[garydgregory]

@JuditKnoll
TY for your analysis and feedback.
I'll wait to release the Apache Commons Parent POM for this fix. Would you please set expectations as to a release date?

[JuditKnoll]

IMO SpotBugs 4.8.5 will be released in a few weeks time, if nothing really messed up comes up which should be addressed in the next release.

[garydgregory]

Great, ty.

[hazendaz]

I think we could speed up release. A number of issues are fixed and release isn't difficult so maybe sooner. It might make more sense we do so given we are starting to get duplicated tickets on fixed issues. Personally, I was thinking cut something this weekend and nothing new next release or two until we fix this mess 😞 given FP it might be easier to cut some losses and solve what we got solved. While not ideal it would at least add more focus on what else is broken. I presume many are trying to align parent releases on mavens current flurry of releases going on right now as am I and at least getting something out is better than nothing. Sent from my Verizon, Samsung Galaxy smartphone Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: Gary Gregory ***@***.***> Sent: Wednesday, April 24, 2024 10:00:51 AM To: spotbugs/spotbugs ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [spotbugs/spotbugs] Version 4.8.4 false positive SING_SINGLETON_GETTER_NOT_SYNCHRONIZED (Issue #2967) Great, ty. — Reply to this email directly, view it on GitHub<#2967 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAHODI7OC7H4K5TYIHEEOWLY663JHAVCNFSM6AAAAABGVUAXR2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANZVGAZDGNRQGY>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[garydgregory]

I like RERO ! 👍 😄