Unbounded memory use of LRUMap due to removed access synchronization in ProviderBase

[e-hubert-opti]

Unbounded memory use of LRUMap due to removed access synchronization in ProviderBase

[jansupol]

@e-hubert-opti Can you describe the process leading to the ineffective value of _maxEntries? How do the multiple threads skip the check?

[e-hubert-opti]

Maybe sharing simple unit tests helps more than long descriptions?

@Test
void test_sequential_usage_of_lru_map() {
    Map<Integer, Integer> lruMap = new LRUMap<>(16, 120);

    for (int i = 0; i < 100000; i++) {
        lruMap.put(i, i);
    }

    assertThat(lruMap.size()).isLessThanOrEqualTo(120);
}

@Test
void test_concurrent_usage_of_lru_map() {
    Map<Integer, Integer> lruMap = new LRUMap<>(16, 120);
    ExecutorService executorService = Executors.newFixedThreadPool(10);

    for (int i = 0; i < 100000; i++) {
        int tmp = i;
        executorService.submit(() -> lruMap.put(tmp, tmp));
    }

    assertThat(lruMap.size()).isLessThanOrEqualTo(120);
}

While the first one obviously passes, the second one gives something like this:
java.lang.AssertionError:
Expecting actual:
33670
to be less than or equal to:
120

Replacing the LRUMap with a thread-safe implementation or synchronizing it (e,g. lruMap = Collections.synchronizedMap(new LRUMap<>(16, 120)) ) will of course also turn the second test green again.

[e-hubert-opti]

As the Jackson maintainers were very responsive and immediately replaced the usage of com.fasterxml.jackson.jaxrs.util.LRUMap by com.fasterxml.jackson.databind.util.LRUMap (see FasterXML/jackson-jaxrs-providers@60e6941) I adjusted the import in the test above and it looks likes this implementation also fails. Will try to have a closer look.

[e-hubert-opti]

All good with the change to com.fasterxml.jackson.databind.util.LRUMap. I had a look in the implementation of PrivateMaxEntriesMap and noticed the async draining, so it is just the test which needs to be adjusted for this.

[jansupol]

@e-hubert-opti Thank you, we'll use Jackson 2.16.1 with the fix when available.

[jansupol]

2.16.1 is released.