{"action":"created","issue":{"url":"https://api.github.com/repos/vaadin/framework/issues/7328","repository_url":"https://api.github.com/repos/vaadin/framework","labels_url":"https://api.github.com/repos/vaadin/framework/issues/7328/labels{/name}","comments_url":"https://api.github.com/repos/vaadin/framework/issues/7328/comments","events_url":"https://api.github.com/repos/vaadin/framework/issues/7328/events","html_url":"https://github.com/vaadin/framework/issues/7328","id":194786126,"number":7328,"title":"Unprotected access to Vaadin component when session is backed up in a JavaEE cluster environment","user":{"login":"vaadin-bot","id":20280877,"avatar_url":"https://avatars2.githubusercontent.com/u/20280877?v=3","gravatar_id":"","url":"https://api.github.com/users/vaadin-bot","html_url":"https://github.com/vaadin-bot","followers_url":"https://api.github.com/users/vaadin-bot/followers","following_url":"https://api.github.com/users/vaadin-bot/following{/other_user}","gists_url":"https://api.github.com/users/vaadin-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/vaadin-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vaadin-bot/subscriptions","organizations_url":"https://api.github.com/users/vaadin-bot/orgs","repos_url":"https://api.github.com/users/vaadin-bot/repos","events_url":"https://api.github.com/users/vaadin-bot/events{/privacy}","received_events_url":"https://api.github.com/users/vaadin-bot/received_events","type":"User","site_admin":false},"labels":[{"id":16896444,"url":"https://api.github.com/repos/vaadin/framework/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/vaadin/framework/milestones/270","html_url":"https://github.com/vaadin/framework/milestone/270","labels_url":"https://api.github.com/repos/vaadin/framework/milestones/270/labels","id":2186783,"number":270,"title":"Vaadin 7.6.3","description":"","creator":{"login":"vaadin-bot","id":20280877,"avatar_url":"https://avatars2.githubusercontent.com/u/20280877?v=3","gravatar_id":"","url":"https://api.github.com/users/vaadin-bot","html_url":"https://github.com/vaadin-bot","followers_url":"https://api.github.com/users/vaadin-bot/followers","following_url":"https://api.github.com/users/vaadin-bot/following{/other_user}","gists_url":"https://api.github.com/users/vaadin-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/vaadin-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vaadin-bot/subscriptions","organizations_url":"https://api.github.com/users/vaadin-bot/orgs","repos_url":"https://api.github.com/users/vaadin-bot/repos","events_url":"https://api.github.com/users/vaadin-bot/events{/privacy}","received_events_url":"https://api.github.com/users/vaadin-bot/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":13,"state":"closed","created_at":"2016-12-09T12:57:13Z","updated_at":"2016-12-10T19:14:16Z","due_on":"2016-02-16T08:00:00Z","closed_at":"2016-12-09T12:57:13Z"},"comments":7,"created_at":"2015-11-26T15:49:44Z","updated_at":"2017-03-20T16:56:38Z","closed_at":"2016-02-14T12:11:13Z","body":"**Originally by _mvysny2_**\n\n___\nAccording to http://stackoverflow.com/questions/25392398/is-session-replication-a-part-of-java-ee-standard the JavaEE server is allowed to serialize and transfer the session at any time, even when a servlet call is ongoing. That is IMHO what is happening in JBoss EAP - the infinispan framework starts serializing VaadinSession in a background thread, without obtaining of any Vaadin lock. The VaadinSession in turn serializes all UIs (the VaadinSessio.uIs Map), which in turn serialize all Vaadin components. I can imagine that a ConcurrentModificationException may happen if a Vaadin Component modifies its map while infinispan is reading the map for serialization purposes. I believe that a custom VaadinSession.writeObject implementation which serializes UI instances while lock()ed would do the trick, but I would very much like some senior Vaadin developer to look at this if this makes sense.\n\nPlease find more information here: https://vaadin.com/forum/#!/thread/3215254/3215253\n\nWe have verified that those JBoss EAP serialization-related exceptions go away when the serializations are executed while protected by a Vaadin lock. I have placed the lock only around our special object which takes long time to serialize and is highly vulnerable to concurrent modifications. In the next step I will try to extend VaadinSession with one which has the following impl of writeObject(), to see if the problem goes away:\n\nprivate void writeObject(ObjectOutputStream stream) throws IOException {\n  lock.lock();\n  try {\n    stream.defaultWriteObject();\n  } finally {\n    lock.unlock();\n  }\n}\n\n\n___\n Imported from https://dev.vaadin.com/ issue #19310"},"comment":{"url":"https://api.github.com/repos/vaadin/framework/issues/comments/287824612","html_url":"https://github.com/vaadin/framework/issues/7328#issuecomment-287824612","issue_url":"https://api.github.com/repos/vaadin/framework/issues/7328","id":287824612,"user":{"login":"struberg","id":79310,"avatar_url":"https://avatars3.githubusercontent.com/u/79310?v=3","gravatar_id":"","url":"https://api.github.com/users/struberg","html_url":"https://github.com/struberg","followers_url":"https://api.github.com/users/struberg/followers","following_url":"https://api.github.com/users/struberg/following{/other_user}","gists_url":"https://api.github.com/users/struberg/gists{/gist_id}","starred_url":"https://api.github.com/users/struberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/struberg/subscriptions","organizations_url":"https://api.github.com/users/struberg/orgs","repos_url":"https://api.github.com/users/struberg/repos","events_url":"https://api.github.com/users/struberg/events{/privacy}","received_events_url":"https://api.github.com/users/struberg/received_events","type":"User","site_admin":false},"created_at":"2017-03-20T16:56:37Z","updated_at":"2017-03-20T16:56:37Z","body":"FYI: We suffer from the same problem after updating from 7.5.5 to 7.7.7. Customer is running WebSphere.\r\nI think that both EAP and WebSphere should not serialize while a request to a session is still handled. Whenever a request serving a session is in progress the whole underlying session might be subject to change. \r\nServers need to use reader/writer semaphores on the requests to first let all the ongoing requests finish, block all new requests to a session - then do their serialisation - and open the gates again.\r\n\r\nThat would also remove the need to lock inside Vaadin imo.\r\n\r\n> JavaEE server is allowed to serialize and transfer the session at any time\r\n\r\nI'm not sure if this statement is correct. It is certainly undefined in the EE spec. But not the EE spec will slap them, but Donald E. Knuth will do - or the reality (sic!)\r\n"}}
{"actor":{"display_login":"struberg"}}