See JBAS-7123.

The work Paul Ferraro did with LockValve ensures that typically application activity cannot reach the clustered session manager after its stop() processing executes, but testing is showing the StandardHostValve can end up causing calls to findSession that end up blowing up with an NPE. That's the specific issue; in general, the methods in the Manager API need to be hardened to react properly if invoked during/after shutdown.

Solution is to use the same semaphore that LockValve uses, but use it internally – add tryLock/release calls around the relevant code. Once stop() processing proceeds, tryLock will fail and the methods can react appropriately.