SessionTracker memory leak on WebSockets that close immediately

[acdcjunior]

Jetty version(s)

Tested on: 11.0.3 and 11.0.6

Java version/vendor (use: java -version)

Tested on:

• jre/jdk 11.0.10_9 (openj9-0.24.0)
• openjdk hotspot 11.0.12+7

OS type/version

Tested on: Windows 10, Linux Alpine

Description

Opening a WebSocket that immediately closes leaves a session instance indefinitely on
org.eclipse.jetty.websocket.common.SessionTracker#sessions.

By "a WebSocket that immediately closes" I mean a WebSocketConnectionListener that closes the WebSocket on the onWebSocketConnect method. Example:

// kotlin
object : WebSocketConnectionListener {
    override fun onWebSocketConnect(session: Session?) {
        session?.close(1008, "I am closing you right away because reason")
    }
} // For the full example in context, see code below.

Don't know if it matters, but I am using this "immediately closed WebSocket" because this was the only way I managed to pass a close reasong (a string, for instance) to the client. Any other ways (e.g. throwing an exception) would terminate the connection with status 1006 and no reason.

Root cause analysis

I have tried to inspect the code a bit to find out what could be causing the leak. From what I could understand, the problem is the SessionTracker not removing the sessions for the "immediately-closed-WebSockets" (ICWS) due to a race condition between its session opened and session closed methods:

• SessionTracker listens to all WebSocket session events (it implements WebSocketSessionListener)
• If you place breakpoints in SessionTracker#onWebSocketSessionOpened() and SessionTracker#onWebSocketSessionClosed() you will notice that, for the ICWS, they are called out of order, that is, for the same session instance, first onWebSocketSessionClosed() is called then onWebSocketSessionOpened() is, thus leaving the session in the sessions set indefinitely.

Workaround

I have managed to contain the leak by registering an aditional WebSocketSessionListener that, for every opened session, checks if it is closed. If it is, the listener then removes the session from SessionTracker#sessions via reflection.

Workaround code is commented out in the snippet below.

How to reproduce?

// kotlin
import jakarta.servlet.ServletContext
import org.eclipse.jetty.server.Server
import org.eclipse.jetty.server.ServerConnector
import org.eclipse.jetty.servlet.ServletContextHandler
import org.eclipse.jetty.websocket.api.Session
import org.eclipse.jetty.websocket.api.WebSocketConnectionListener
import org.eclipse.jetty.websocket.server.JettyWebSocketServerContainer
import org.eclipse.jetty.websocket.server.config.JettyWebSocketServletContainerInitializer


fun main() {
    val server = Server()

    val connector = ServerConnector(server)
    connector.port = 8080
    server.addConnector(connector)

    val context = ServletContextHandler(ServletContextHandler.SESSIONS)
    context.contextPath = "/"

    server.handler = context

    JettyWebSocketServletContainerInitializer.configure(context) { _: ServletContext?, wsContainer: JettyWebSocketServerContainer ->
        wsContainer.addMapping("/ws") { _, _ ->
            object : WebSocketConnectionListener {
                override fun onWebSocketConnect(session: Session?) {
                    session?.close(1008, "I am a WS that closes immediately")
                }
            }
        }

        // workaround
//        wsContainer.addSessionListener(object : WebSocketSessionListener {
//            override fun onWebSocketSessionOpened(session: Session?) {
//                if (!session!!.isOpen) {
//                    val sessionTracker = wsContainer.javaClass.getDeclaredField("sessionTracker")
//                    sessionTracker.isAccessible = true
//                    (sessionTracker.get(wsContainer) as SessionTracker).onWebSocketSessionClosed(session)
//                }
//            }
//        })
    }

    server.start()
    server.join()
}

Run main() above and open many connections:

// javascript
new WebSocket("http://localhost:8080/ws")
new WebSocket("http://localhost:8080/ws")
new WebSocket("http://localhost:8080/ws")

By inspecting org.eclipse.jetty.websocket.common.SessionTracker#sessions, you'll see the sessions are held even after whe WebSockets are closed (to inspect it, put a breakpoint on SessionTracker#onWebSocketSessionOpened or SessionTracker#onWebSocketSessionClosed and try to connect a ws).

To use the workaround, uncomment the code and run again. Notice the sessions aren't stacked up anymore.

The code is in Kotlin just because it was the language I was using and it was simpler for me to elaborate the snippet. If you want, let me know and I can convert it to Java.

[lachlan-roberts]

@acdcjunior thanks for the detailed report.
I think this should be relatively straightforward to fix, I will put up a PR.