Fixes WebappClassLoader race condition on definePackage

Signed-off-by: Alexander Pinčuk <[email protected]>

Author: avpinchuk

appserver/web/war-util/src/main/java/org/glassfish/web/loader/WebappClassLoader.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022, 2024 Contributors to the Eclipse Foundation
+ * Copyright (c) 2022, 2025 Contributors to the Eclipse Foundation.
  * Copyright (c) 1997, 2018 Oracle and/or its affiliates. All rights reserved.
  * Copyright 2004 The Apache Software Foundation
  *
@@ -47,10 +47,13 @@
 import java.util.Collections;
 import java.util.Enumeration;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentLinkedQueue;
 import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
 import java.util.function.Function;
 import java.util.jar.Attributes;
 import java.util.jar.Attributes.Name;
@@ -171,6 +174,9 @@ public final class WebappClassLoader extends GlassfishUrlClassLoader
     /** Associated directory context giving access to the resources in this webapp. */
     private DirContext jndiResources;
 
+    /** Maps package name to the corresponding lock object. */
+    private final Map<String, Lock> packageLocks = new ConcurrentHashMap<>();
+
     /**
      * Should this class loader delegate to the parent class loader
      * <strong>before</strong> searching its own repositories (i.e. the
@@ -1147,6 +1153,8 @@ public void close() throws IOException {
             LOG.log(WARNING, "Parent close method failed.", e);
         }
 
+        packageLocks.clear();
+
         notFoundResources.clear();
         resourceEntryCache.clear();
         pathTimestamps.clear();
@@ -1244,18 +1252,23 @@ private ResourceEntry findClassInternal(String name) throws ClassNotFoundExcepti
             // Looking up the package
             final int pos = name.lastIndexOf('.');
             final String packageName = pos == -1 ? null : name.substring(0, pos);
-            final Package pkg;
+            Package pkg;
             if (packageName == null) {
                 pkg = null;
             } else {
                 pkg = getDefinedPackage(packageName);
 
                 // Define the package (if null)
                 if (pkg == null) {
-                    if (entry.manifest == null) {
-                        definePackage(packageName, null, null, null, null, null, null, null);
-                    } else {
-                        definePackage(packageName, entry.manifest, entry.codeBase);
+                    Lock packageLock = getPackageDefinigLock(packageName);
+                    packageLock.lock();
+                    try {
+                        pkg = getDefinedPackage(packageName);
+                        if (pkg == null) {
+                            definePackage(packageName, entry);
+                        }
+                    } finally {
+                        packageLock.unlock();
                     }
                 }
             }
@@ -1279,6 +1292,30 @@ private ResourceEntry findClassInternal(String name) throws ClassNotFoundExcepti
         }
     }
 
+    /**
+     * Defines a Package of the given name.
+     *
+     * @param packageName the name of the to-be-defined package
+     * @param resourceEntry the resource entry
+     */
+    private void definePackage(String packageName, ResourceEntry resourceEntry) {
+        if (resourceEntry.manifest == null) {
+            definePackage(packageName, null, null, null, null, null, null, null);
+        } else {
+            definePackage(packageName, resourceEntry.manifest, resourceEntry.codeBase);
+        }
+    }
+
+    /**
+     * Returns the lock object for package defining operations.
+     *
+     * @param packageName the name of the to-be-defined package
+     * @return the lock for package defining operations
+     */
+    private Lock getPackageDefinigLock(String packageName) {
+        return packageLocks.computeIfAbsent(packageName, key -> new ReentrantLock());
+    }
+
 
     /**
      * Attempts to find the specified resource in local repositories.