In OutputCommitCoordinator, there is some logic to clear the authorized committer's lock on committing in case it fails. However, it looks like the current code also clears this lock if other tasks fail, which is an obvious bug: https://github.com/apache/spark/blob/df3550084c9975f999ed370dd9f7c495181a68ba/core/src/main/scala/org/apache/spark/scheduler/OutputCommitCoordinator.scala#L118. In theory, it's possible that this could allow a new committer to start, run to completion, and commit output before the authorized committer finished, but it's unlikely that this race occurs often in practice due to the complex combination of failure and timing conditions that would be required to expose it. Still, we should fix this issue.
This was discovered by Aaron Davidson while reading the OutputCommitCoordinator code.