Fix SpotBugs warnings and tighten quality gates

[shai-almog]

Motivation

• Silence several SpotBugs findings (null param deref, non-short-circuit logic, Boolean reference comparisons, instance locking on shared static data, dead local store) while keeping existing behavior intact.
• Make the CI quality gate stricter by failing the build on the identified SpotBugs rules so regressions are caught early.

Description

• Guard FacebookRESTService.keyValue against a null key and normalize null values to an empty string before calling put (keyValue).
• Validate fontKey in HTMLComponent.addFont by throwing IllegalArgumentException for null keys and perform toLowerCase() before inserting into fonts.
• Replace non-short-circuit bitwise checks with logical short-circuit operators in DeflaterOutputStream.write (use ||) and TBigInteger.modPow (use || / &&) to avoid evaluation surprises.
• Replace Boolean reference comparisons with Boolean.TRUE.equals(...) in InstantUI.isExcludedProperty and BrowserComponent.isDebugMode to avoid reference-comparison pitfalls.
• Introduce a dedicated static lock LISTENER_LOCK and synchronize on it in LocationManager.setLocationListener and setBackgroundLocationListener to avoid using instance-level locks when modifying static listener fields.
• Remove a dead local store assignment to baseStyle in UIManager.createStyle to eliminate a dead-store warning.
• Extend the SpotBugs quality gate in .github/scripts/generate-quality-report.py to treat the rules NP_NULL_PARAM_DEREF, NS_NON_SHORT_CIRCUIT, SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA, DLS_DEAD_LOCAL_STORE_OF_NULL, and RC_REF_COMPARISON_BAD_PRACTICE_BOOLEAN as build-breaking violations.

Testing

• No automated tests were executed as part of this change (no mvn or unit test runs were performed).

---

Codex Task

[github-actions]

✅ Continuous Quality Report

Test & Coverage

• ✅ Tests: 2282 total, 0 failed, 0 skipped
• 📊 Line coverage: 52.82% [HTML preview] [Download]
  • Lowest covered classes
    • com.codename1.io.rest.RequestBuilder$FetchAsPropertyListActionListener – 0.00%
    • com.codename1.io.rest.RequestBuilder$FetchAsPropertiesActionListener – 0.00%
    • com.codename1.ui.Display$EdtException – 0.00%
    • com.codename1.ui.BrowserWindow$BrowserForm – 0.00%
    • com.codename1.ui.plaf.CSSBorder$LinearGradient – 0.00%
    • com.codename1.io.rest.RequestBuilder$GetAsStringAsyncImplActionListener – 0.00%
    • com.codename1.io.rest.RequestBuilder$GetAsJsonMapActionListener – 0.00%
    • com.codename1.payment.Purchase$SynchronizeReceiptsSyncRunnable – 0.00%
    • com.codename1.io.rest.RequestBuilder$GetAsBytesAsyncImplActionListener – 0.00%
    • com.codename1.io.rest.RequestBuilder$FetchAsJsonMapActionListener – 0.00%

Static Analysis

• ❌ SpotBugs: 28 findings (Normal: 21, Low: 7) [HTML preview] [Download]
  • Top findings
    • Normal: CodenameOne/src/com/codename1/capture/Capture.java:267 – Inconsistent synchronization of com.codename1.capture.Capture$CallBack.completed; locked 66% of time (rule: IS2_INCONSISTENT_SYNC)
    • Normal: CodenameOne/src/com/codename1/impl/CodenameOneThread.java:152 – com.codename1.impl.CodenameOneThread.getStack(Throwable) may fail to close stream (rule: OS_OPEN_STREAM)
    • Normal: CodenameOne/src/com/codename1/io/BufferedInputStream.java:642 – Self comparison of BufferedInputStream.buf with itself in com.codename1.io.BufferedInputStream.close() (rule: SA_FIELD_SELF_COMPARISON)
    • Normal: CodenameOne/src/com/codename1/io/BufferedInputStream.java:385 – com.codename1.io.BufferedInputStream.yieldTime() calls Thread.sleep() with a lock held (rule: SWL_SLEEP_WITH_LOCK_HELD)
    • Normal: CodenameOne/src/com/codename1/io/Util.java:2016 – com.codename1.io.Util.guessMimeType(InputStream) ignores result of java.io.InputStream.read(byte[], int, int) (rule: RR_NOT_CHECKED)
    • …and 23 more
• ❌ PMD: 2552 findings (P2: 1, P3: 481, P4: 2070) [HTML preview] [Download]
  • Top findings
    • P2: CodenameOne/src/com/codename1/ui/Display.java:1039 – Avoid using a branching statement as the last in a loop. (rule: AvoidBranchingStatementAsLastInLoop)
    • P3: CodenameOne/src/com/codename1/charts/views/LineChart.java:208 – These nested if statements could be combined (rule: CollapsibleIfStatements)
    • P3: CodenameOne/src/com/codename1/components/RSSReader.java:500 – Overriding method merely calls super (rule: UselessOverridingMethod)
    • P3: CodenameOne/src/com/codename1/facebook/Album.java:198 – Overriding method merely calls super (rule: UselessOverridingMethod)
    • P3: CodenameOne/src/com/codename1/facebook/FaceBookAccess.java:1312 – Unnecessary semicolon (rule: UnnecessarySemicolon)
    • …and 2547 more
• ❌ Checkstyle: 220915 findings (Warning: 220915) [HTML preview] [Download]
  • Top findings
    • Warning: CodenameOne/src/com/codename1/db/ThreadSafeDatabase.java:30:1 – Extra separation in import group before 'java.io.IOException' (rule: CustomImportOrderCheck)
    • Warning: CodenameOne/src/com/codename1/db/ThreadSafeDatabase.java:32 – First sentence of Javadoc is missing an ending period. (rule: SummaryJavadocCheck)
    • Warning: CodenameOne/src/com/codename1/db/ThreadSafeDatabase.java:36 – Line is longer than 100 characters (found 143). (rule: LineLengthCheck)
    • Warning: CodenameOne/src/com/codename1/db/ThreadSafeDatabase.java:39:5 – 'member def modifier' has incorrect indentation level 4, expected level should be 2. (rule: IndentationCheck)
    • Warning: CodenameOne/src/com/codename1/db/ThreadSafeDatabase.java:40:5 – 'member def modifier' has incorrect indentation level 4, expected level should be 2. (rule: IndentationCheck)
    • …and 220910 more

Generated automatically by the PR CI workflow.

[shai-almog]

Compared 30 screenshots: 30 matched.

Native Android coverage

• 📊 Line coverage: 24.85% (2663/10717 lines covered) [HTML preview] (artifact android-coverage-report, jacocoAndroidReport/html/index.html)
  • Other counters: instruction 24.47% (12362/50528), branch 15.33% (716/4672), complexity 17.52% (743/4241), method 33.08% (602/1820), class 34.98% (106/303)
  • Lowest covered classes
    • com.codename1.impl.android.com.codename1.impl.android.AndroidContactsManager – 0.00% (0/400 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidImplementation$Video – 0.00% (0/168 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.IntentIntegrator – 0.00% (0/139 lines covered)
    • com.codename1.impl.android.util.com.codename1.impl.android.util.Base64 – 0.00% (0/117 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidImplementation$SocketImpl – 0.00% (0/77 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidTextureView – 0.00% (0/76 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidSurfaceView – 0.00% (0/73 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.LocalNotificationPublisher – 0.00% (0/65 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.FridaDetectionUtil – 0.00% (0/64 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.PushNotificationService – 0.00% (0/59 lines covered)

✅ Native Android screenshot tests passed.

Native Android coverage

• 📊 Line coverage: 24.85% (2663/10717 lines covered) [HTML preview] (artifact android-coverage-report, jacocoAndroidReport/html/index.html)
  • Other counters: instruction 24.47% (12362/50528), branch 15.33% (716/4672), complexity 17.52% (743/4241), method 33.08% (602/1820), class 34.98% (106/303)
  • Lowest covered classes
    • com.codename1.impl.android.com.codename1.impl.android.AndroidContactsManager – 0.00% (0/400 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidImplementation$Video – 0.00% (0/168 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.IntentIntegrator – 0.00% (0/139 lines covered)
    • com.codename1.impl.android.util.com.codename1.impl.android.util.Base64 – 0.00% (0/117 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidImplementation$SocketImpl – 0.00% (0/77 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidTextureView – 0.00% (0/76 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.AndroidSurfaceView – 0.00% (0/73 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.LocalNotificationPublisher – 0.00% (0/65 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.FridaDetectionUtil – 0.00% (0/64 lines covered)
    • com.codename1.impl.android.com.codename1.impl.android.PushNotificationService – 0.00% (0/59 lines covered)

[shai-almog]

iOS screenshot updates

Compared 30 screenshots: 23 matched, 6 updated, 1 missing reference.

• BrowserComponent — updated screenshot. Screenshot differs (1206x2622 px, bit depth 8).

  
  Preview info: Preview provided by instrumentation.
  Full-resolution PNG saved as BrowserComponent.png in workflow artifacts.

• graphics-draw-arc — updated screenshot. Screenshot differs (1206x2622 px, bit depth 8).

  
  Preview info: JPEG preview quality 20; JPEG preview quality 20; downscaled to 603x1311.
  Full-resolution PNG saved as graphics-draw-arc.png in workflow artifacts.

• graphics-draw-gradient — updated screenshot. Screenshot differs (1206x2622 px, bit depth 8).

  
  Preview info: JPEG preview quality 10; JPEG preview quality 10; downscaled to 844x1835.
  Full-resolution PNG saved as graphics-draw-gradient.png in workflow artifacts.

• graphics-draw-round-rect — missing reference. Reference screenshot missing at /Users/runner/work/CodenameOne/CodenameOne/scripts/ios/screenshots/graphics-draw-round-rect.png.

  
  Preview info: JPEG preview quality 10; JPEG preview quality 10; downscaled to 844x1835.
  Full-resolution PNG saved as graphics-draw-round-rect.png in workflow artifacts.

• graphics-draw-string — updated screenshot. Screenshot differs (1206x2622 px, bit depth 8).

  
  Preview info: JPEG preview quality 10; JPEG preview quality 10; downscaled to 422x918.
  Full-resolution PNG saved as graphics-draw-string.png in workflow artifacts.

• graphics-draw-string-decorated — updated screenshot. Screenshot differs (1206x2622 px, bit depth 8).

  
  Preview info: JPEG preview quality 10; JPEG preview quality 10; downscaled to 603x1311.
  Full-resolution PNG saved as graphics-draw-string-decorated.png in workflow artifacts.

• kotlin — updated screenshot. Screenshot differs (1206x2622 px, bit depth 8).

  
  Preview info: Preview provided by instrumentation.
  Full-resolution PNG saved as kotlin.png in workflow artifacts.

Benchmark Results

• VM Translation Time: 300 seconds
• Compilation Time: 77 seconds

Detailed Performance Metrics

Metric	Duration
Build Time Statistics
Setup & Unzip	25013 ms
Extract Extensions	11 ms
Google Services Setup	1 ms
Scan Classes	863 ms
Extract Libs	638 ms
Inject Build Hints	30 ms
Generate Unit Tests	2 ms
Generate Stubs	852 ms
Compile Stubs	1830 ms
Generate Icons	932 ms
Prepare ParparVM	157 ms
ParparVM Execution	185660 ms
Post-VM Setup	97 ms
CocoaPods	4426 ms
Finalize	10 ms
Total Time	220522 msMaven Overhead : 80000 ms
CocoaPods Install (Script)	1000 ms
Simulator Boot (Run)	44000 ms
App Install	11000 ms
App Launch	6000 ms
Test Execution	135000 ms