roryqi commented on PR #13747: URL: https://github.com/apache/gravitino/pull/13747#issuecomment-6121749492
There may be a lost-update race while initializing request-local active-role subjects.\n\n is shared by the parallel list-filter workers, but both and call the unsynchronized . The prefetch guard is also check-then-act, so multiple workers can concurrently observe .\n\nOne possible interleaving for a narrowed ActiveRoles request is:\n\n1. Worker A publishes prefetched versions, enters , observes empty , and pauses before publishing the empty set.\n2. Worker B publishes the bound role IDs and computes the correct active-role set.\n3. Worker A resumes and overwrites it with the empty set.\n\nThe final request state then has held roles but no active subjects, so subsequent list checks can fail closed or hide otherwise visible objects nondeterministically. I do not see an elevation path here because active subjects are still derived only from bound IDs, but this looks like a correctness regression.\n\nThe new list-filter regression test replaces the executor with , so it does not ex ercise this initialization concurrently.\n\nCould we publish one immutable role snapshot atomically, or synchronize the setters/recomputation and make prefetch single-flight? A barrier-based test with narrowed ActiveRoles and real concurrent workers would also cover this case. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
