Uploaded image for project: 'Weld'
  1. Weld
  2. WELD-1419

BeanStore for HttpSessionContextImpl is not thread safe

    Details

    • Type: Bug
    • Status: Resolved (View Workflow)
    • Priority: Critical
    • Resolution: Cannot Reproduce
    • Affects Version/s: 1.1.12.Final, 1.2.0.Beta1, 2.0.0.CR4
    • Fix Version/s: None
    • Component/s: Scopes & Contexts
    • Labels:
      None

      Description

      org.jboss.weld.context.http.HttpSessionContextImpl is the multithreaded context. Also it uses these classes for internal BeanStore:
      org.jboss.weld.context.beanstore.http.LazySessionBeanStore
      org.jboss.weld.context.beanstore.http.EagerSessionBeanStore

      Under the hood these BeanStore_s use HashMap as storage for beans (AbstractSessionBeanStore -> AttributeBeanStore.beanStore.delegate).

      However implementation for retrieving bean from the context does not provide additional synchronization for read operation. See
      org.jboss.weld.context.AbstractContext.get(Contextual<T>,CreationalContext<T>) line 90 - not synchronized reading from BeanStore (HashMap):
      ContextualInstance<T> beanInstance = beanStore.get(id);

      This can cause infinite loop because of concurrent modification for HashMap.

      This problem does not affect other multithreaded Context impl in Weld (ApplicationContextImpl and SingletonContextImpl), because they use ConcurrentHashMapBeanStore with ConcurrentHashMap inside (see AbstractSharedContext.beanStore).

        Gliffy Diagrams

          Attachments

            Activity

              People

              • Assignee:
                jharting Jozef Hartinger
                Reporter:
                werdnar Andrew Ryapolov
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: