[Actionframework-users] severe bug in session cleanup

[Mark D. A. <md...@di...>]

Right now, ActionServlet is registering a HttpSessionBindingListener with the container.
This object's handler calls destroySession.
The ActionRuntime.destroySession method calls session.invalidate().
With some containers, this causes an infinite loop and causes the JVM to crash.
It all depends on whether the container is using synchronized methods, and the order
in which the container invokes listener callbacks relative to when it remoes things
from its data structure.

The code is apparently safe with Jetty, but with WebSphere it kills the JVM.

At the minimum, ActionServlet should be changed to distinguish between a destroySession
that is called explicitly, versus destroySession that is called from the HttpSessionBindingListener
(and so should not call invalidate).

-mda