When a pre-existing instance of Servlet class is added dynamically by calling ServletContext.addServlet(String, Servlet) in ServletContainerInitializer, multiple problems arise: * setLoadOnStartup() is ignored * @ServletSecurity is ignored * destroy() can be called on non-initialized servlet Adding a servlet class (addServlet(String, String), addServlet(String, Class)) doesn't have this problems. It happens because methods of org.apache.catalina.core.StandardWrapper treat presence of servlet instance as an indicator of the fact that servlet have been initialized, that is not true when addServlet(String, Servlet) is used.
(In reply to comment #0) > * @ServletSecurity is ignored This is as required by the Servlet spec (section 13.4.1) so this aspect of the bug report is INVALID. This is also made clear in the Servlet 3.0 Javadoc. I'm still researching the other issues. The specification is ambiguous on what to do here. I'm leaning towards making a change but I need to check that any such change doesn't trigger any TCK failures.
The Servlet TCK still passes with my change in place so I am going to go ahead and commit it to fix this issue. I'll be a little while as I need to write a test case first.
Fixed in 7.0.x and will be included in 7.0.17 onwards.
(In reply to comment #3) > Fixed in 7.0.x and will be included in 7.0.17 onwards. This one is still unresolved: * destroy() can be called on non-initialized servlet If servlet added via addServlet(String, Servlet) without setLoadOnStartup() was never accessed, its destroy() method is called during shutdown despite the fact that init() was never called.
Thanks for the catch. Fixed in 7.0.x and will be in 7.0.17 onwards.