Recreate transient pendingAccessQueue in readObject() (#12456)

This prevents a race condition in getPendingAccessQueue().

Change-Id: I1b8d013119e5963ed6083b7dd17afccd3a915e42

1 files changed, 17 insertions, 9 deletions

diff --git a/server/src/com/vaadin/server/VaadinSession.java b/server/src/com/vaadin/server/VaadinSession.java
index 1f7a577a42..c73ac8b686 100644
--- a/server/src/com/vaadin/server/VaadinSession.java
+++ b/server/src/com/vaadin/server/VaadinSession.java
@@ -16,6 +16,8 @@
 
 package com.vaadin.server;
 
+import java.io.IOException;
+import java.io.ObjectInputStream;
 import java.io.Serializable;
 import java.lang.reflect.Method;
 import java.util.Collection;
@@ -203,10 +205,10 @@ public class VaadinSession implements HttpSessionBindingListener, Serializable {
      * session is serialized as long as it doesn't happen while some other
      * thread has the lock.
      */
-    private transient ConcurrentLinkedQueue<FutureAccess> pendingAccessQueue;
+    private transient ConcurrentLinkedQueue<FutureAccess> pendingAccessQueue = new ConcurrentLinkedQueue<FutureAccess>();
 
     /**
-     * Create a new service session tied to a Vaadin service
+     * Creates a new VaadinSession tied to a VaadinService.
      * 
      * @param service
      *            the Vaadin service for the new session
@@ -1272,18 +1274,15 @@ public class VaadinSession implements HttpSessionBindingListener, Serializable {
     }
 
     /**
-     * Gets the queue of tasks submitted using {@link #access(Runnable)}.
+     * Gets the queue of tasks submitted using {@link #access(Runnable)}. It is
+     * safe to call this method and access the returned queue without holding
+     * the {@link #lock() session lock}.
      * 
      * @since 7.1
      * 
-     * @return the pending access queue
+     * @return the queue of pending access tasks
      */
     public Queue<FutureAccess> getPendingAccessQueue() {
-        if (pendingAccessQueue == null) {
-            // pendingAccessQueue is transient, so will be null after
-            // deserialization
-            pendingAccessQueue = new ConcurrentLinkedQueue<FutureAccess>();
-        }
         return pendingAccessQueue;
     }
 
@@ -1299,4 +1298,13 @@ public class VaadinSession implements HttpSessionBindingListener, Serializable {
         return csrfToken;
     }
 
+    /**
+     * Override default deserialization logic to account for transient
+     * {@link #pendingAccessQueue}.
+     */
+    private void readObject(ObjectInputStream stream) throws IOException,
+            ClassNotFoundException {
+        stream.defaultReadObject();
+        pendingAccessQueue = new ConcurrentLinkedQueue<FutureAccess>();
+    }
 }