Merge branch '2.18'

.github/workflows/main.yml

@@ -4,6 +4,7 @@ on:
     branches:
     - master
     - "3.0"
+    - "2.18"
     - "2.17"
     paths-ignore:
     - "README.md"
@@ -12,6 +13,7 @@ on:
     branches:
     - master
     - "3.0"
+    - "2.18"
     - "2.17"
     paths-ignore:
     - "README.md"

release-notes/CREDITS-2.x

@@ -1765,3 +1765,9 @@ Kyrylo Merzlikin (kirmerzlikin@github)
 Miguel Mendes Ruiz (migmruiz@github)
  * Reported #4428: `ByteBuddy` scope went beyond `test` in version 2.17.0
   (2.17.1)
+
+Oddbjørn Kvalsund (oddbjornkvalsund@github)
+ * Reported, contributed fix for #4430: Use `ReentrantLock` instead of `synchronized`
+   in `DeserializerCache` to avoid deadlock on pinning
+  (2.17.1)
+

release-notes/VERSION-2.x

@@ -13,6 +13,9 @@ Project: jackson-databind
 #4428: `ByteBuddy` scope went beyond `test` in version 2.17.0
  (reported by Miguel M-R)
  (fix by Joo-Hyuk K)
+#4430: Use `ReentrantLock` instead of `synchronized` in `DeserializerCache`
+  to avoid deadlock on pinning
+ (reported, fix contributed by Oddbjørn K)
 #4435: Cannot deserialize value of type `java.math.BigDecimal` from
   String ".05": not a valid representation
  (reported by @EAlf91)

src/main/java/tools/jackson/databind/deser/DeserializerCache.java

@@ -1,6 +1,7 @@
 package tools.jackson.databind.deser;
 
 import java.util.HashMap;
+import java.util.concurrent.locks.ReentrantLock;
 
 import com.fasterxml.jackson.annotation.JsonFormat;
 
@@ -54,6 +55,12 @@ public final class DeserializerCache
     private final transient HashMap<JavaType, ValueDeserializer<Object>> _incompleteDeserializers
         = new HashMap<>(8);
 
+
+    /**
+     * We hold an explicit lock while creating deserializers to avoid creating duplicates.
+     */
+    private final ReentrantLock _incompleteDeserializersLock = new ReentrantLock();
+
     /*
     /**********************************************************************
     /* Life-cycle
@@ -212,7 +219,9 @@ protected ValueDeserializer<Object> _createAndCacheValueDeserializer(Deserializa
          * limitations necessary to ensure that only completely initialized ones
          * are visible and used.
          */
-        synchronized (_incompleteDeserializers) {
+        try {
+            _incompleteDeserializersLock.lock();
+
             // Ok, then: could it be that due to a race condition, deserializer can now be found?
             ValueDeserializer<Object> deser = _findCachedDeserializer(type);
             if (deser != null) {
@@ -235,6 +244,8 @@ protected ValueDeserializer<Object> _createAndCacheValueDeserializer(Deserializa
                     _incompleteDeserializers.clear();
                 }
             }
+        } finally {
+            _incompleteDeserializersLock.unlock();
         }
     }