Bug 910185 - Weld's TypeSafeObserverResolver cache is unbounded
Summary: Weld's TypeSafeObserverResolver cache is unbounded
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: CDI/Weld
Version: 6.0.1
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ER6
: EAP 6.2.0
Assignee: Jozef Hartinger
QA Contact: Ron Šmeral
URL:
Whiteboard:
Depends On:
Blocks: 1003581
TreeView+ depends on / blocked
 
Reported: 2013-02-11 23:53 UTC by James Livingston
Modified: 2018-12-01 17:09 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-12-15 16:55:30 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker WELD-1323 0 Major Resolved resolved cache in TypeSafeObserverResolver is unbounded 2018-02-07 16:10:31 UTC

Description James Livingston 2013-02-11 23:53:34 UTC
The cache in TypeSafeObserverResolver, as used by TransactionalObserverNotifier does not have any form of limiting or expiry, which means that it could grow very large and cause an OutOfMemoryError if a large number of distinct qualifier are used.

Usually the number of qualifiers is finite (and relatively small), but this is not true if an application uses AnnotationLiteral-derived classes with arbitrary data in the annoation. An example of where this occurs is Solder's ServletEventBridgeListener, which emits events with a qualifier annotation containing the URL path and method.

The cache should have some form of limit or expiry, so that it does not grow arbitrarily large.

Comment 2 JBoss JIRA Server 2013-05-17 11:25:12 UTC
Jozef Hartinger <jharting> updated the status of jira WELD-1323 to Resolved

Comment 8 Marek Schmidt 2013-10-17 14:15:26 UTC
Should this be moved to ON_QA?

Comment 9 Brian Stansberry 2013-10-17 15:31:00 UTC
If this was fixed in some release of Weld that's in the EAP 6.x branch, please move it to ON_QA, setting the Target Release to EAP 6.2.0 and the Target Milestone to ER6. If you know the # of the first ER that had the fix in the build, then use that, but if you don't know then ER6 is fine.

Comment 10 Marek Schmidt 2013-10-22 08:38:24 UTC
Verified on EAP 6.2.0.ER6


Note You need to log in before you can comment on or make changes to this bug.