We recently had a minor incident with one of our production JVMs. The VM ran out of memory despite most objects not being strongly referenced. However, we noticed that a large percentage (25%) of heap memory was tied to objects awaiting finalization. Almost all of those are subtypes of FinalizedClientResponse. The presence of the finalize method delays GC's ability to clean these up. It also holds byte[] buffers as well as the buffered entity, even after you close the response object, since they are referred to by the finalizable object.

The finalize() method is now deprecated for removal, and future JDK versions will not honor it:

https://openjdk.java.net/jeps/421

I propose that RESTEasy should remove all finalizers from the codebase. It's inefficient and prone to failures, as the JEP and our experience points out. Clients must correctly manage their resources by calling close(). If a fallback cleanup is still deemed necessary, it should be a new mechanism based on a ReferenceQueue.

I found finalizers in:

client/jaxrs/internal/FinalizedClientResponse.java
client/jaxrs/engines/ReactorNettyClientHttpEngine.java
client/jaxrs/engines/ApacheHttpClient43Engine.java
plugins/providers/multipart/MultipartInputImpl.java
plugins/providers/multipart/MultipartFormDataInputImpl.java