[CXF-8125] Support for using thread-safe application-defined StAX-factories

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.3.3
• Fix Version/s: 3.2.11, 3.3.4, 3.4.0
• Component/s: Core
• Estimated Complexity: Unknown
• Assignee: Freeman Yue Fang
• Reporter: Barnabas Bodnar
• Created: 28/Sep/19 22:03
• Updated: 22/Dec/21 20:43
• Resolved: 30/Sep/19 16:23

Description

CXF assumes, application-defined (contextual property of the message) StAX-factories are not thread-safe and synchronizes accesses to them (eg. in org.apache.cxf.interceptor.StaxInInterceptor):

XMLInputFactory factory = getXMLInputFactory(message);
if (factory == null) {
 if (reader != null) {
 xreader = StaxUtils.createXMLStreamReader(reader);
 } else {
 xreader = StaxUtils.createXMLStreamReader(is, encoding);
 }
} else {
 synchronized (factory) {
 if (reader != null) {
 xreader = factory.createXMLStreamReader(reader);
 } else {
 xreader = factory.createXMLStreamReader(is, encoding);
 }
 }

This is basically correct, because the StAX-spec doesn't require a XMLInputFactory or a XMLOutputFactory to be thread-safe.

However, this becomes problematic right with CXF's preferred StAX-implementation, WSTX, because it performs I/O (reads a few bytes) in createXMLStreamReader():

    at java.io.FilterInputStream.read(FilterInputStream.java:133)
    at com.ctc.wstx.io.BaseReader.readBytes(BaseReader.java:155)
    at com.ctc.wstx.io.UTF8Reader.loadMore(UTF8Reader.java:369)
    at com.ctc.wstx.io.UTF8Reader.read(UTF8Reader.java:112)
    at com.ctc.wstx.io.ReaderBootstrapper.initialLoad(ReaderBootstrapper.java:254)
    at com.ctc.wstx.io.ReaderBootstrapper.bootstrapInput(ReaderBootstrapper.java:134)
    at com.ctc.wstx.stax.WstxInputFactory.doCreateSR(WstxInputFactory.java:573)
    at com.ctc.wstx.stax.WstxInputFactory.createSR(WstxInputFactory.java:633)
    at com.ctc.wstx.stax.WstxInputFactory.createSR(WstxInputFactory.java:657)
    at com.ctc.wstx.stax.WstxInputFactory.createXMLStreamReader(WstxInputFactory.java:342)
    at org.apache.cxf.interceptor.StaxInInterceptor.handleMessage(StaxInInterceptor.java:134)
    - locked <0x00000006f7ceef50> (a com.ctc.wstx.stax.WstxInputFactory)

If this synchronous read-operation blocks due to network issues, all other incoming SOAP-requests are blocked:

java.lang.Thread.State: BLOCKED (on object monitor)
    at org.apache.cxf.interceptor.StaxInInterceptor.handleMessage(StaxInInterceptor.java:130)
    - waiting to lock <0x00000006f7ceef50> (a com.ctc.wstx.stax.WstxInputFactory)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    - locked <0x0000000781907170> (a org.apache.cxf.phase.PhaseInterceptorChain)
    at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
    at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:267)
    at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234)

Even if performing I/O here is a questionable behavior of WSTX, unneeded synchronization should anyway be avoided for performance reasons. My proposal is to introduce a boolean contextual property indicating whether the provided factories are thread-safe and omit the synchronization, if set to true.

Issue Links

• links to: GitHub Pull Request #582