Bug 487694 - Race condition in annotation unpacking can surface through Spring AOP
Summary: Race condition in annotation unpacking can surface through Spring AOP
Status: RESOLVED FIXED
Alias: None
Product: AspectJ
Classification: Tools
Component: Compiler (show other bugs)
Version: DEVELOPMENT   Edit
Hardware: PC Mac OS X
: P3 normal (vote)
Target Milestone: 1.8.9   Edit
Assignee: aspectj inbox CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-02-11 16:48 EST by Andrew Clement CLA
Modified: 2016-02-11 17:00 EST (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Clement CLA 2016-02-11 16:48:21 EST
See the Spring bug https://jira.spring.io/browse/SPR-13380.  I don't have a spring test case but I determined that the inflate() mechanism in RuntimeAnnos (and in RuntimeParamAnnos) can get into trouble if two threads are in it at the same time for the same JavaClass.  The Java15AnnotationFinder says:

JavaClass jc = bcelRepository.loadClass(forClass);
org.aspectj.apache.bcel.classfile.annotation.AnnotationGen[] anns = jc.getAnnotations();
bcelRepository.clear();
if (anns == null)
  return ResolvedType.NONE;
ResolvedType[] ret = new ResolvedType[anns.length];
for (int i = 0; i < ret.length; i++) {
  ret[i] = inWorld.resolve(UnresolvedType.forSignature(anns[i].getTypeSignature()));
}
return ret;

If two threads go through here asking about the same class they will potentially get the same JavaClass back from the repository (if the first thread hasn't called 'clear' before the second thread asks the repository for the class).  Annotations are unpacked on demand and if two threads ask for them at the same time they will both be unpacking simultaneously and the unpack code is not thread safe.
Comment 1 Andrew Clement CLA 2016-02-11 17:00:16 EST
Made RuntimeAnnos inflate() safe, and RuntimeParamAnnos too which had the same issue (but no-one seems to have hit that yet).