Bug 58522

Summary: concurrency problem corrupts WARDirContext.Entry children
Product: Tomcat 7 Reporter: Ryan Fong <ryan.fong>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal    
Priority: P2    
Version: 7.0.52   
Target Milestone: ---   
Hardware: All   
OS: All   
Attachments: everything
Proposal

Description Ryan Fong 2015-10-22 19:54:03 UTC 
We discovered a problem where calling ServletContext.getResourcePaths from a jsp may corrupt WARDirContext.Entry.children. The WARDirContext.list(Entry) method performs an Arrays.sort(children) call which is not thread-safe. Calling this from multiple request threads may result in the children array losing some entries and duplicating others.

When entries representing directories in the war are lost, Tomcat cannot load resources from there. Static resource requests result in http error code 404 and jsp compliation can throw JasperException when included files are not found.

We have seen this on CentOS 6.5 (and newer versions) with Tomcat 7.0.52 and Java 1.7.0_51.

The following are attached in the zip:
* Test case project which demonstrates this corruption. It usually requires multiple runs.
* A stack trace illustrating the problematic flow.
* A patch file for WARDirContext.java.
Comment 1 Ryan Fong 2015-10-22 20:09:55 UTC 
Created attachment 33195 [details]
everything
Comment 2 Violeta Georgieva 2015-10-23 15:07:07 UTC 
Created attachment 33201 [details]
Proposal

Hi,

Can you test the different approach that I have.

I also do not like the idea that the original array is returned but I didn't tested the performance if I return a copy of the array.

Regards,
Violeta
Comment 3 Ryan Fong 2015-10-23 15:52:03 UTC 
G'day, Violeta. Your proposal looks great. In fact, it will likely improve throughput since we only deploy the war once and your patch avoids unnecessary sorting on all subsequent calls. Thank you!
Comment 4 Violeta Georgieva 2015-10-23 18:40:47 UTC 
Hi,

The fix is provided in 7.0.x trunk and will be available in 7.0.66 onwards.

Regards,
Violeta