gnodet commented on PR #704:
URL: https://github.com/apache/creadur-rat/pull/704#issuecomment-5104337001

   @Claudenw I did a thorough audit of the codebase for other static mutable 
state that could cause issues under parallel builds. Here are the results:
   
   ### Already fixed in this PR
   1. `DefaultLog` — static singleton → ThreadLocal
   2. `DeprecationReporter` — static singleton → ThreadLocal
   3. `OptionCollection.parseCommands()` — synchronized (protects 
`OptionGroup.selected` and `Converters.FILE_CONVERTER.workingDirectory`)
   4. `SPDXMatcherFactory` — ThreadLocal factory in `SpdxBuilder`
   
   ### Remaining: `MatcherBuilderTracker`
   
   The `instance()` method is `synchronized`, which protects lazy init. 
However, `addBuilderImpl()` and `getMatcherBuilder()` operate on a plain 
`HashMap` *after* the `instance()` call returns — those HashMap operations are 
not synchronized.
   
   In practice the risk is low: the map is mostly populated once during 
`Defaults.init()` inside the synchronized init block. But concurrent 
`addBuilder()` calls from modules with custom matcher XML configs (via 
`XMLConfigurationReader.readMatcherBuilders()`) could corrupt the map.
   
   Minimal fix would be `HashMap` → `ConcurrentHashMap`, but leaving this for a 
follow-up as discussed.
   
   ### Everything else: safe
   
   All other static fields I checked (13+) are either immutable after class 
loading, stateless singletons, use `ConcurrentHashMap`, or are already 
protected by the `synchronized parseCommands()`:
   - `CLIOptionCollection.INSTANCE` — mutable `OptionGroup.selected`, but 
protected by synchronized `parseCommands()`
   - `Converters.FILE_CONVERTER` — mutable `workingDirectory`, but protected by 
synchronized `parseCommands()`
   - `BaseRatMojo` static maps — populated once in static init, read-only
   - `TikaProcessor.TIKA` — Tika is documented as thread-safe
   - `DocumentName.FSInfo.REGISTRY` — uses `ConcurrentHashMap`
   - `SelectorUtils.INSTANCE`, `UnknownLicense.INSTANCE` — stateless/immutable 
singletons


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to