I ran FindBugs 1.2.1 over JRuby trunk (the Eclipse plugin is quite nice).
Some issues fixed by the attached patch:
Various minor issues.
Inconsistent synchronization of org.jruby.RubyThread.finalResult
Unsynchronized access at RubyThread.java:[line 245]
Synchronized access at RubyThread.java:[line 401]
RubyString.java:[line 1732]
Bad attempt to compute absolute value of signed 32-bit random integer
This code generates a random signed integer and then computes the absolute value of that random integer. If the number returned by the random number generator is Integer.MIN_VALUE, then the result will be negative as well (since Math.abs(Integer.MIN_VALUE) == Integer.MIN_VALUE).
Issues that look like they should be fixed:
org.jruby.RubyTime uses a static DateFormat, as does org.jvyamlb.RepresenterImpl$DateYAMLNodeCreator. This might be a problem because "as the JavaDoc states, DateFormats are inherently unsafe for multithreaded use."
In RubyModule's addClassProvider:
This method may contain an instance of double-checked locking. This idiom is not correct according to the semantics of the Java memory model. For more information, see the web page
http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html
In RubyZlib.java:[line 784] ce is compared to -1:
Bad comparison of nonnegative value with negative constant
This code compares a value that is guaranteed to be non-negative with a negative constant.
There are various cases reported as "Inefficient use of keySet iterator instead of entrySet iterator".
I'm not worried right now about this particular usage, since, as things currently stand, a) there will be at most one ClassProvider for a module, and b) re-initialization would be harmless, as there's only one instance of ClassProvider, period. (Some may recall this was part of my little hack to enable the double-colon syntax for opening Java classes - I sort of over-engineered this bit )
However, there is a more worrisome instance of this usage in RubyObject#getInstanceVariables. Unless someone has a better idea, I'm going to just make that a synchronized method.