Order release of RequestScoped beans to prevent NPE

Signed-off-by: jansupol <[email protected]>

Author: jansupol

inject/hk2/src/main/java/org/glassfish/jersey/inject/hk2/Hk2RequestScope.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, 2021 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2017, 2025 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -16,8 +16,9 @@
 
 package org.glassfish.jersey.inject.hk2;
 
-import java.util.HashMap;
-import java.util.HashSet;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicInteger;
 import java.util.logging.Level;
@@ -63,7 +64,7 @@ public static final class Instance implements org.glassfish.jersey.process.inter
         private final AtomicInteger referenceCounter;
 
         private Instance() {
-            this.store = new HashMap<>();
+            this.store = new LinkedHashMap<>();
             this.referenceCounter = new AtomicInteger(1);
         }
 
@@ -140,7 +141,9 @@ public boolean contains(ForeignDescriptor provider) {
         public void release() {
             if (referenceCounter.decrementAndGet() < 1) {
                 try {
-                    new HashSet<>(store.keySet()).forEach(this::remove);
+                    ArrayList<ForeignDescriptor> reverse = new ArrayList<>(store.keySet());
+                    Collections.reverse(reverse);
+                    reverse.forEach(this::remove);
                 } finally {
                     logger.debugLog("Released scope instance {0}", this);
                 }

tests/e2e-core-common/src/test/java/org/glassfish/jersey/tests/e2e/common/process/internal/RequestScopeTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2022 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2025 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -17,6 +17,8 @@
 package org.glassfish.jersey.tests.e2e.common.process.internal;
 
 import java.lang.reflect.Type;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.Consumer;
 
 import org.glassfish.jersey.inject.hk2.Hk2RequestScope;
 import org.glassfish.jersey.internal.inject.ForeignDescriptor;
@@ -25,6 +27,7 @@
 import org.glassfish.hk2.api.ServiceHandle;
 import org.glassfish.hk2.utilities.AbstractActiveDescriptor;
 
+import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNull;
@@ -140,6 +143,34 @@ public void testMultipleGetInstanceCalls() throws Exception {
         assertNull(instance.get(inhab));
     }
 
+    @Test
+    public void testOrderOfRelease() {
+        final RequestScope requestScope = new Hk2RequestScope();
+        final AtomicInteger instanceRelease = new AtomicInteger(0);
+        final Hk2RequestScope.Instance instance = requestScope.runInScope(() -> {
+            final Hk2RequestScope.Instance internalInstance = (Hk2RequestScope.Instance) requestScope.current();
+            for (int index = 1; index != 10; index++) {
+                final int in = index;
+                TestProvider testProvider = new TestProvider(String.valueOf(in)) {
+                    @Override
+                    public int hashCode() {
+                        return super.hashCode() + in;
+                    }
+                };
+                final ForeignDescriptor fd = ForeignDescriptor.wrap(testProvider, new Consumer<Object>() {
+                    @Override
+                    public void accept(Object o) {
+                        instanceRelease.set(instanceRelease.get() * 10 + in);
+                    }
+                });
+                internalInstance.put(fd, String.valueOf(index));
+            }
+            return internalInstance;
+        });
+        instance.release();
+        Assertions.assertEquals(987654321, instanceRelease.get());
+    }
+
     /**
      * Test request scope inhabitant.
      */