From 493e5d7f460cf6c41b858ac6e0abafe177f4a71c Mon Sep 17 00:00:00 2001
From: Leif Åstrand <leif@vaadin.com>
Date: Sun, 14 Feb 2016 12:17:10 +0200
Subject: Lock session during deserialization (#19310)

Change-Id: I0f0c029d6de88b74bae1c7253b7665d5570e3767
---
 server/src/com/vaadin/server/VaadinSession.java | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

(limited to 'server/src')

diff --git a/server/src/com/vaadin/server/VaadinSession.java b/server/src/com/vaadin/server/VaadinSession.java
index bcc07acb99..304dd4bec6 100644
--- a/server/src/com/vaadin/server/VaadinSession.java
+++ b/server/src/com/vaadin/server/VaadinSession.java
@@ -18,6 +18,7 @@ package com.vaadin.server;
 
 import java.io.IOException;
 import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
 import java.io.Serializable;
 import java.lang.reflect.Method;
 import java.util.Collection;
@@ -1419,6 +1420,26 @@ public class VaadinSession implements HttpSessionBindingListener, Serializable {
         }
     }
 
+    /**
+     * Override default serialization logic to avoid
+     * ConcurrentModificationException if the contents are modified while
+     * serialization is reading them.
+     */
+    private void writeObject(ObjectOutputStream out) throws IOException {
+        Lock lock = this.lock;
+
+        if (lock != null) {
+            lock.lock();
+        }
+        try {
+            out.defaultWriteObject();
+        } finally {
+            if (lock != null) {
+                lock.unlock();
+            }
+        }
+    }
+
     /**
      * Finds the UI with the corresponding embed id.
      *
-- 
cgit v1.2.3