[MRESOLVER-38] SOE/OOME in DefaultDependencyNode.accept

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Maven Artifact Resolver 1.1.0, 1.3.3
• Fix Version/s: 1.4.2
• Component/s: Resolver
• Assignee: Michael Osipov
• Reporter: Andreas Sewe
• Created: 04/Dec/17 12:13
• Updated: 27/Apr/20 12:43
• Resolved: 27/Apr/20 11:38

Description

I noticed a StackOverflowErrror when trying to build the classpath for org.webjars.npm:n3-charts:2.0.17 using Maven Resolver 1.1.0.

I’ve managed to produce a minimal example based on the maven-resolver-demos from the master-with-demos branch. To reproduce, just apply the attached patch to the branch (tried this with commit 84a32a86) and run the GetDependencyTree example:

------------------------------------------------------------
GetDependencyTree
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
Resolving artifact org.webjars.npm:n3-charts:pom:2.0.17
Resolved artifact org.webjars.npm:n3-charts:pom:2.0.17 from central (https://repo.maven.apache.org/maven2/, default, releases+snapshots)
…
Resolving metadata org.webjars.npm:uglifycss/maven-metadata.xml from central (https://repo.maven.apache.org/maven2/, default, releases+snapshots)
Resolved metadata org.webjars.npm:uglifycss/maven-metadata.xml from central (https://repo.maven.apache.org/maven2/, default, releases+snapshots)
Resolving artifact org.webjars.npm:uglifycss:pom:0.0.18
Resolved artifact org.webjars.npm:uglifycss:pom:0.0.18 from central (https://repo.maven.apache.org/maven2/, default, releases+snapshots)
Exception in thread "main" java.lang.StackOverflowError
	at org.eclipse.aether.util.graph.visitor.PathRecordingDependencyVisitor.visitEnter(PathRecordingDependencyVisitor.java:102)
	at org.eclipse.aether.graph.DefaultDependencyNode.accept(DefaultDependencyNode.java:341)
	at org.eclipse.aether.graph.DefaultDependencyNode.accept(DefaultDependencyNode.java:345)
	at org.eclipse.aether.graph.DefaultDependencyNode.accept(DefaultDependencyNode.java:345)
	at org.eclipse.aether.graph.DefaultDependencyNode.accept(DefaultDependencyNode.java:345)

(Note: The patch changes the plexus-utils version as well, as I was getting a ClassNotFoundException for org.codehaus.plexus.util.xml.pull.EntityReplacementMap otherwise.)

Issue Links

• depends upon: MRESOLVER-93 PathRecordingDependencyVisitor to handle 3 cycles
• is related to: MNG-5592 Maven dependency resolution locks up
• is related to: MNG-6737 StackOverflowError when version ranges are unsolvable and graph contains a cycle