Tidy the map as we go

If the set has been emptied in and onCacheEviction call, then remove
it from the map.

Author: joegallo

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/accesscontrol/DocumentSubsetBitsetCache.java

@@ -192,10 +192,15 @@ private void onCacheEviction(RemovalNotification<BitsetCacheKey, BitSet> notific
                 // it's possible for the key to be back in the cache if it was immediately repopulated after it was evicted, so check
                 if (bitsetCache.get(cacheKey) == null) {
                     // key is no longer in the cache, make sure it is no longer in the lookup map either.
-                    final Set<BitsetCacheKey> keys = keysByIndex.get(indexKey);
-                    if (keys != null) {
-                        keys.remove(cacheKey);
-                    }
+                    keysByIndex.compute(indexKey, (ignored, keys) -> {
+                        if (keys != null) {
+                            keys.remove(cacheKey);
+                            if (keys.isEmpty()) {
+                                keys = null;
+                            }
+                        }
+                        return keys;
+                    });
                 }
             }
         });
@@ -426,6 +431,11 @@ void verifyInternalConsistency() {
                 throw new IllegalStateException("Key [" + cacheKey + "] is in the lookup map, but is not in the cache");
             }
         });
+        keysByIndex.forEach((indexKey, keys) -> {
+            if (keys == null || keys.isEmpty()) {
+                throw new IllegalStateException("The lookup entry for [" + indexKey + "] is null or empty");
+            }
+        });
     }
 
 }