Bug caused by using ThreadLocal

[Migrated From Jforum.net]

Hi,

I use your JForum with SSO and encountered quite a serious bug. I installed JForum on a performance tuned production server and I was plagued by weird things. The main thing what went wrong was that when someone logged in, and someone else logged in on an other PC or even in a different browser, JForum confused the names of the two persons. When one person posted, it for example showed the name of the other every now and then.

I looked at the code and determined that it is probably caused by the use of ThreadLocals. The entire forum assumes that each request is processed by different threads, but that is generally not the case. The execution context class should be passed to all necessary classes or methods to solve the bad ThreadLocal assumption, instead of storing it in ThreadLocals. I think this is quite a serious bug...
[originally posted on jforum.net by anoko]

[Migrated From Jforum.net]

hhm..ThreadLocal is a very common parttern, and application servers are supposed to use only one thread per request.

What usually happens when a scenario like yours occurs is that the ThreadLocal resources are not being freed, which causes the container to "reuse" information, due to the thread pool.

When using JForum's ThreadLocal implementation, all code should be in a try-finally block, where, in the finally call, the resources are released.

JForum Servlet (JForum.java) does that, so you can take a look at how it acts.

Rafael
[originally posted on jforum.net by Rafael Steil]