738388 - org.mozilla.javascript.ClassCache non thread-safe use of HashMap with 1.7R3

Status: RESOLVED FIXED

(Rhino Graveyard :: Core, defect, P1)

Description

[Gabriel Lavoie]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Build ID: 20120312181643

Steps to reproduce:

Two threads using the same scope made calls to Java functions returning objects of the same type. Rhino tried to wrap both object as NativeJavaObject at the same time.


Actual results:

One thread got stuck in an infinite loop in the JavaMembers.lookupClass() method, at the "members = ct.get(cl);" line.

The problem is caused by "ct" being a HashMap. This HashMap got accessed by the two threads and the HashMap class is NOT thread-safe. This problem was introduced when the following change was done in the ClassCache class to replace the Hashtable instances with WeakHashMap instances, that eventually got replaced by HashMap instances:
https://github.com/mozilla/rhino/commit/fac646cca584c234dad54ebddd2157039b0f39cf


Expected results:

Both threads should have been able to wrap the Java objects of the same class at the same time. All the HashMap instances of ClassCache should be reverted to Hashtable or replaced with ConcurrentHashMap instances.

Comment 1

[Gabriel Lavoie]

The following thread talks about the same issue:
http://groups.google.com/group/mozilla.dev.tech.js-engine.rhino/browse_thread/thread/5a51b7b96f33d274?pli=1

Comment 2

[Hannes Wallnoefer]

Fixed in e83014775c28dc4d884f37023e19b05136b2ac5e