abhu85 opened a new pull request, #13304: URL: https://github.com/apache/maven/pull/13304
Backport of #11734 (already on `master`, and on `maven-4.0.x` via #12284) to `maven-3.9.x`. A backport to the 3.x line was requested on #11734 (https://github.com/apache/maven/pull/11734#issuecomment-5158052289) and has not been answered. ### Problem `DefaultModelValidator` is a `@Singleton`, and its `validIds` cache is a plain `HashSet` shared by every validation that runs through it. Callers that validate models concurrently (the breadth-first dependency collector, `aether.dependencyCollector.impl=bf`, as used by Clojure tools-deps and Leiningen; IDE integrations such as NetBeans) can corrupt the underlying `HashMap`. #11618 reports a `ClassCastException` (`HashMap$Node cannot be cast to class HashMap$TreeNode`). ### Change Same as on `master` and `maven-4.0.x`: - `validIds` is `ConcurrentHashMap.newKeySet()`; - `validateId()` checks `id != null` before `contains()`, since a `ConcurrentHashMap` key set throws on a `null` lookup. A `null` id still reaches `validateStringNotEmpty()` and is reported as before. The regression test `testConcurrentValidation()` is the one from #11734, unchanged. ### Verification on `maven-3.9.x` - `mvn -pl maven-model-builder verify` (including spotless and RAT): BUILD SUCCESS, 160 tests (68 in `DefaultModelValidatorTest`), 0 failures. - `git diff --check` is clean. - I also stress-tested the singleton directly: 16 threads × 2000 unique models per round, 50 rounds, one shared `DefaultModelValidator`. - **Without the change:** 3 of 3 runs never finished and were killed after 60 s. A thread dump showed the threads spinning in `HashMap$TreeNode.balanceInsertion()` under `validateId()`. Short single-round runs threw the `ClassCastException` reported in #11618. - **With the change:** all 150 rounds complete in about 1 s with no failures. `testConcurrentValidation()` is probabilistic. In my runs a single iteration of that load hit the race about 1 time in 8, so it guards against the bug coming back but will not fail on every run against the unfixed code. - [x] I hereby declare this contribution to be licenced under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) Refs #11618 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
