ben-manes / caffeine / #5444 / 1

100%

master: 100%

push

github

Close the loadAll/close TOCTOU window with a sentinel under the configuration lock

CacheProxy.loadAll and LoadingCacheProxy.loadAll registered their future
with inFlight after runAsync returned. A concurrent close() could sample
inFlight while it was still empty, return without waiting, then watch the
loadAll's listener fire after close() had already returned — violating
the documented "close waits for all in-flight loads" invariant.

Use a sentinel CompletableFuture: add it to inFlight under
synchronized(configuration) (the lock close() takes), then submit the
real runAsync outside the lock. The runAsync's whenComplete removes the
sentinel and completes it. If the executor rejects (close shut it down
between the lock release and the submit), a catch-all unhooks the
sentinel so close() does not block 10s for a future that never arrives.
This also keeps the lock window short, so a caller-runs executor doesn't
deadlock by running the loader inline under the lock.

Required promoting CacheProxy.configuration from private to protected
so LoadingCacheProxy can sync on the same lock.

Audit finding iss_2245e004 (.claude/reports/audit-temporal-walk-jcache).

3988 of 3996 branches covered (99.8%)

8191 of 8199 relevant lines covered (99.9%)

1.0 hits per line