On 13/10/2026 18:05, Rémy Maucherat wrote: <snip/>
- Proposed fix: Make the decision and the removal atomic per session ID, e.g. in `StoreBase.processExpires()` acquire `manager.getStore().getSessionStoreLock(key).writeLock()` around the `isLoaded` check/`expire()`/`remove(key)` block, and in `ManagerBase.remove(Session, boolean)` only remove when the mapped object is the same instance (`sessions.remove(id, session)`), so a concurrently swapped-in session can never be evicted by a stale copy. But since it is so unlikely, I am ok with reverting and seeing what the next review says. So I'll do that. It would need to come up with a better testcase.
That is amusing. I was looking at the code and reached the conclusion that adding the lock was the right fix.
I'll add the lock shortly. With the lock, the object check should be unnecessary.
Mark --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
