Race condition in MonoCollect leads to NullPointerException

[rstoyanchev]

The example in spring-projects/spring-framework#25216 shows a NullPointerException in the logs:

java.lang.NullPointerException: null
at reactor.core.publisher.MonoCollect$CollectSubscriber.onNext(MonoCollect.java:124) [reactor-core-3.3.6.RELEASE.jar:3.3.6.RELEASE]
at reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:114) [reactor-core-3.3.6.RELEASE.jar:3.3.6.RELEASE]
at reactor.core.publisher.FluxPeek$PeekSubscriber.onNext(FluxPeek.java:192) [reactor-core-3.3.6.RELEASE.jar:3.3.6.RELEASE]
at reactor.core.publisher.FluxPeek$PeekSubscriber.onNext(FluxPeek.java:192) [reactor-core-3.3.6.RELEASE.jar:3.3.6.RELEASE]
at reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:114) [reactor-core-3.3.6.RELEASE.jar:3.3.6.RELEASE]
at reactor.netty.channel.FluxReceive.onInboundNext(FluxReceive.java:330) [reactor-netty-0.9.8.RELEASE.jar:0.9.8.RELEASE]
...

This happens while collecting buffers in DataBufferUtils#join and what's null is the value field (the container collecting the items) and not the action. In a debugger this is where the NPE is raised:

at org.springframework.core.io.buffer.DataBufferUtils$$Lambda$340.551556520.accept(Unknown Source:-1)
at reactor.core.publisher.MonoCollect$CollectSubscriber.onNext(MonoCollect.java:124)
at reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:114)
at reactor.core.publisher.FluxPeek$PeekSubscriber.onNext(FluxPeek.java:192)
at reactor.core.publisher.FluxPeek$PeekSubscriber.onNext(FluxPeek.java:192)
at reactor.core.publisher.FluxMap$MapSubscriber.onNext(FluxMap.java:114)
at reactor.netty.channel.FluxReceive.onInboundNext(FluxReceive.java:330)

As far as I can see in MonoCollect around line 124 the value field is passed in as-is but it can be set to null in Operators around line 1728 in the cancel method of MonoSubscriber. Probably the code should look more like what is in MonoCollectList with a local variable and a null check.