Our project loads and unloads a lot of bundles over time, and we have noticed that the JVM quickly spends the majority of its time collecting its garbage.
We have identified the Framework Security extension as one source of this problem. Specifically, the suspiciously large number of Conditions and Permissions objects in every heap dump.
The Permissions objects are definitely leaking because Permission.Entry.hashCode() should use Arrays.hashCode(entry) instead of entry.hashCode() when entry is an array.
I have also reimplemented Conditions to listen for BundleEvent.UNINSTALLED instead of relying on multiple WeakHashMaps. This is consistent with a TODO comment for this class, and allows the Conditions objects to be deleted immediately instead of waiting for the garbage collector to realise that they are no longer referenced.