goneall
commented
1 year ago Does it seem right for the spdx-gradle-plugin to access the default model store from several threads concurrently for writing several spdx documents? Is ModelObject() expected to be threadsafe?
Yes - it should be thread-safe. From looking at the code, this does look like an issue with the library. I should be able to resolve this by wrapping the code with enter/exit critical section. I noticed a similar issue in the getObjectPropertyValue code.
I'll create a pull request to fix.
mathjeff
AndroidX is trying out https://github.com/spdx/spdx-gradle-plugin and finding that occasionally
./gradlew spdxSbomForReleasefails with a stacktrace that looks like this:So far we've only noticed this failure when parallelism is enabled (--max-workers > 1)
I believe that what is happening is that the Gradle plugin is calling
SpdxNoAssertionLicense()from multiple threads at once, and that the code at https://github.com/spdx/Spdx-Java-Library/blob/da021dffa3c2376f2aa2654863fb000be2aa7d2a/src/main/java/org/spdx/library/model/ModelObject.java#L198 is checking the default model store multiple times for the existence of this object (each time finding it has not been created), and then each thread tries to create it at https://github.com/spdx/Spdx-Java-Library/blob/da021dffa3c2376f2aa2654863fb000be2aa7d2a/src/main/java/org/spdx/library/model/ModelObject.java#L204 and the second creation fails.Does it seem right for the spdx-gradle-plugin to access the default model store from several threads concurrently for writing several spdx documents? Is ModelObject() expected to be threadsafe?
Thanks!