Lock session during deserialization (#19310)

Change-Id: I0f0c029d6de88b74bae1c7253b7665d5570e3767

1 files changed, 21 insertions, 0 deletions

diff --git a/server/src/com/vaadin/server/VaadinSession.java b/server/src/com/vaadin/server/VaadinSession.java
index bcc07acb99..304dd4bec6 100644
--- a/server/src/com/vaadin/server/VaadinSession.java
+++ b/server/src/com/vaadin/server/VaadinSession.java
@@ -18,6 +18,7 @@ package com.vaadin.server;
 
 import java.io.IOException;
 import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
 import java.io.Serializable;
 import java.lang.reflect.Method;
 import java.util.Collection;
@@ -1420,6 +1421,26 @@ public class VaadinSession implements HttpSessionBindingListener, Serializable {
     }
 
     /**
+     * Override default serialization logic to avoid
+     * ConcurrentModificationException if the contents are modified while
+     * serialization is reading them.
+     */
+    private void writeObject(ObjectOutputStream out) throws IOException {
+        Lock lock = this.lock;
+
+        if (lock != null) {
+            lock.lock();
+        }
+        try {
+            out.defaultWriteObject();
+        } finally {
+            if (lock != null) {
+                lock.unlock();
+            }
+        }
+    }
+
+    /**
      * Finds the UI with the corresponding embed id.
      *
      * @since 7.2