SAP / SAP/cloud-sdk-java

GsonVdmEntityAdapter causes intermittent IllegalAccessException on VdmComplex subclasses under concurrent serialization

Open
#1,226 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
41
Forks
33
Avg merge
18h 34m
Merged PRs (30d)
19

Description

Describe the Bug

From time to time, we could observe some error logs like "Could not serialize property 'ratingPeriodStart'. Returning null instead." from logger "com.sap.cloud.sdk.datamodel.odatav4.adapter.GsonVdmEntityAdapter".

After some analysis, here is the issue:
GsonVdmEntityAdapter stores java.lang.reflect.Field objects in a shared entityProperties map. Under concurrent serialization, the setAccessible(false) restore call on a shared Field object races with another
thread's Field.get(), causing an intermittent IllegalAccessException.

Steps to Reproduce

Reproduction

Using UsageRecordAggregationRequest (a generated VdmComplex subclass) with 100 concurrent threads each performing 100,000 serializations. Reproduces ~60% of test runs.

  // Mirrors ActionRequestBuilder's static final fields exactly
  private static final Gson GSON = new GsonBuilder().serializeNulls().create();
  private static final GsonVdmAdapterFactory GSON_VDM_ADAPTER_FACTORY = new GsonVdmAdapterFactory();

  @SuppressWarnings("unchecked")
  private static String serializeRequests(List<UsageRecordAggregationRequest> requests) {
      var typeToken = TypeToken.get((Class<List<UsageRecordAggregationRequest>>) requests.getClass());
      var adapter = GSON_VDM_ADAPTER_FACTORY.create(GSON, typeToken);
      return adapter != null
              ? adapter.toJsonTree(requests).toString()
              : GSON.toJsonTree(requests).toString();
  }

  @Test
  void concurrentSerialization_shouldNotThrowIllegalAccessException() throws Exception {
      // attach ListAppender to GsonVdmEntityAdapter logger to catch swallowed exceptions
      // ... (full test in attachment)

      assertThat(illegalAccessLogs).isZero();
  }

Observed error log:

ERROR GsonVdmEntityAdapter -- Could not serialize property 'ratingPeriodStart'. Returning null instead.
java.lang.IllegalAccessException: class com.sap.cloud.sdk.datamodel.odatav4.adapter.GsonVdmEntityAdapter
cannot access a member of class ...UsageRecordAggregationRequest with modifiers "private"
at jdk.internal.reflect.Reflection.newIllegalAccessException
at java.lang.reflect.AccessibleObject.checkAccess
at java.lang.reflect.Field.checkAccess
at java.lang.reflect.Field.get
at GsonVdmEntityAdapter.getEntityAsJsonObject(GsonVdmEntityAdapter.java:309)

Expected Behavior

No such errors occur.

Screenshots

No response

Used Versions
  • Java and Maven version via mvn --version:
Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
Maven home: /opt/homebrew/Cellar/maven/3.9.16/libexec
Java version: 21.0.11, vendor: SAP SE, runtime: /Library/Java/JavaVirtualMachines/sapmachine-21.jdk/Contents/Home
Default locale: en_CN, platform encoding: UTF-8
OS name: "mac os x", version: "26.5.1", arch: "aarch64", family: "mac"
  • SAP Cloud SDK version: 5.31.0
  • Spring Boot or CAP version: 3.5.16
Dependency tree via mvn dependency:tree 
[INFO] com.sap.ngom:usage-record-client:jar:3.0.0
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:3.5.16:provided
[INFO] |  +- org.springframework.boot:spring-boot-starter:jar:3.5.16:provided
[INFO] |  |  +- org.springframework.boot:spring-boot:jar:3.5.16:provided
[INFO] |  |  +- org.springframework.boot:spring-boot-autoconfigure:jar:3.5.16:provided
[INFO] |  |  +- org.springframework.boot:spring-boot-starter-logging:jar:3.5.16:provided
[INFO] |  |  |  +- ch.qos.logback:logback-classic:jar:1.5.38:provided
[INFO] |  |  |  |  \- ch.qos.logback:logback-core:jar:1.5.38:provided
[INFO] |  |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.25.4:provided
[INFO] |  |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.25.4:provided
[INFO] |  |  |  \- org.slf4j:jul-to-slf4j:jar:2.0.18:provided
[INFO] |  |  +- jakarta.annotation:jakarta.annotation-api:jar:2.1.1:provided
[INFO] |  |  \- org.yaml:snakeyaml:jar:2.4:provided
[INFO] |  +- org.springframework.boot:spring-boot-starter-json:jar:3.5.16:provided
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.21.5:provided
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.21.5:provided
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.21.5:provided
[INFO] |  +- org.springframework.boot:spring-boot-starter-tomcat:jar:3.5.16:provided
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.57:provided
[INFO] |  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.57:provided
[INFO] |  +- org.springframework:spring-web:jar:6.2.19:provided
[INFO] |  |  +- org.springframework:spring-beans:jar:6.2.19:provided
[INFO] |  |  \- io.micrometer:micrometer-observation:jar:1.15.12:provided
[INFO] |  |     \- io.micrometer:micrometer-commons:jar:1.15.12:provided
[INFO] |  \- org.springframework:spring-webmvc:jar:6.2.19:provided
[INFO] |     +- org.springframework:spring-aop:jar:6.2.19:provided
[INFO] |     +- org.springframework:spring-context:jar:6.2.19:provided
[INFO] |     \- org.springframework:spring-expression:jar:6.2.19:provided
[INFO] +- org.springframework.boot:spring-boot-starter-validation:jar:3.5.16:provided
[INFO] |  +- org.apache.tomcat.embed:tomcat-embed-el:jar:10.1.57:provided
[INFO] |  \- org.hibernate.validator:hibernate-validator:jar:8.0.3.Final:provided
[INFO] |     +- jakarta.validation:jakarta.validation-api:jar:3.0.2:provided
[INFO] |     +- org.jboss.logging:jboss-logging:jar:3.6.3.Final:provided
[INFO] |     \- com.fasterxml:classmate:jar:1.7.3:provided
[INFO] +- com.sap.cloud.sdk.datamodel:odata-v4-core:jar:5.31.0:compile
[INFO] |  +- com.sap.cloud.sdk.datamodel:odata-client:jar:5.31.0:compile
[INFO] |  +- com.sap.cloud.sdk.cloudplatform:cloudplatform-core:jar:5.31.0:compile
[INFO] |  +- com.sap.cloud.sdk.cloudplatform:cloudplatform-connectivity:jar:5.31.0:compile
[INFO] |  |  +- com.sap.cloud.sdk.cloudplatform:resilience-api:jar:5.31.0:compile
[INFO] |  |  +- com.sap.cloud.sdk.cloudplatform:security:jar:5.31.0:compile
[INFO] |  |  +- com.sap.cloud.environment.servicebinding.api:java-core-api:jar:0.31.0:compile
[INFO] |  |  +- com.sap.cloud.environment.servicebinding.api:java-access-api:jar:0.31.0:compile
[INFO] |  |  +- com.mikesamuel:json-sanitizer:jar:1.2.3:compile
[INFO] |  |  +- com.auth0:java-jwt:jar:4.5.2:compile
[INFO] |  |  +- org.bouncycastle:bcprov-jdk18on:jar:1.84:compile
[INFO] |  |  \- org.bouncycastle:bcpkix-jdk18on:jar:1.84:compile
[INFO] |  |     \- org.bouncycastle:bcutil-jdk18on:jar:1.84:compile
[INFO] |  +- com.sap.cloud.sdk.cloudplatform:connectivity-apache-httpclient4:jar:5.31.0:compile
[INFO] |  |  +- com.sap.cloud.sdk.cloudplatform:caching:jar:5.31.0:compile
[INFO] |  |  +- com.sap.cloud.sdk.cloudplatform:tenant:jar:5.31.0:compile
[INFO] |  |  \- com.github.ben-manes.caffeine:caffeine:jar:3.2.4:compile
[INFO] |  +- com.sap.cloud.sdk.datamodel:fluent-result:jar:5.31.0:compile
[INFO] |  +- org.slf4j:slf4j-api:jar:2.0.18:compile
[INFO] |  +- org.slf4j:jcl-over-slf4j:jar:2.0.18:runtime
[INFO] |  +- com.google.guava:guava:jar:33.6.0-jre:compile
[INFO] |  |  +- com.google.guava:failureaccess:jar:1.0.3:compile
[INFO] |  |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] |  |  +- org.jspecify:jspecify:jar:1.0.0:compile
[INFO] |  |  +- com.google.errorprone:error_prone_annotations:jar:2.47.0:compile
[INFO] |  |  \- com.google.j2objc:j2objc-annotations:jar:3.1:compile
[INFO] |  +- com.google.code.gson:gson:jar:2.13.2:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-core:jar:2.21.5:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.21.5:compile
[INFO] |  +- org.apache.httpcomponents:httpclient:jar:4.5.14:compile
[INFO] |  |  \- commons-codec:commons-codec:jar:1.18.0:compile
[INFO] |  +- io.vavr:vavr:jar:1.0.1:compile
[INFO] |  |  \- io.vavr:vavr-match:jar:1.0.0:compile
[INFO] |  +- org.apache.httpcomponents:httpcore:jar:4.4.16:compile
[INFO] |  \- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] +- org.projectlombok:lombok:jar:1.18.46:provided
[INFO] +- org.apache.commons:commons-lang3:jar:3.18.0:compile
[INFO] +- com.sap.dwc:util-headers:jar:2.17.0:provided
[INFO] |  +- com.sap.dwc:util-model:jar:2.17.0:provided
[INFO] |  +- org.apache.httpcomponents.client5:httpclient5:jar:5.5.2:provided
[INFO] |  |  \- org.apache.httpcomponents.core5:httpcore5-h2:jar:5.3.6:provided
[INFO] |  +- org.apache.httpcomponents.core5:httpcore5:jar:5.3.6:provided
[INFO] |  \- com.sap.dwc.commons:commons-util:jar:2.23.0:provided
[INFO] +- com.sap.dwc:util-routing:jar:2.17.0:provided
[INFO] +- com.sap.ngom:bc-metric-client:jar:2.0.0-20260623084922_a29592b:compile
[INFO] |  \- com.jayway.jsonpath:json-path:jar:2.9.0:compile
[INFO] \- org.springframework.boot:spring-boot-starter-test:jar:3.5.16:test
[INFO]    +- org.springframework.boot:spring-boot-test:jar:3.5.16:test
[INFO]    +- org.springframework.boot:spring-boot-test-autoconfigure:jar:3.5.16:test
[INFO]    +- jakarta.xml.bind:jakarta.xml.bind-api:jar:4.0.5:test
[INFO]    |  \- jakarta.activation:jakarta.activation-api:jar:2.1.4:test
[INFO]    +- net.minidev:json-smart:jar:2.5.2:runtime
[INFO]    |  \- net.minidev:accessors-smart:jar:2.5.2:runtime
[INFO]    |     \- org.ow2.asm:asm:jar:9.7.1:runtime
[INFO]    +- org.assertj:assertj-core:jar:3.27.7:test
[INFO]    |  \- net.bytebuddy:byte-buddy:jar:1.17.8:test
[INFO]    +- org.awaitility:awaitility:jar:4.2.2:test
[INFO]    +- org.hamcrest:hamcrest:jar:3.0:test
[INFO]    +- org.junit.jupiter:junit-jupiter:jar:5.12.2:test
[INFO]    |  +- org.junit.jupiter:junit-jupiter-api:jar:5.12.2:test
[INFO]    |  |  +- org.opentest4j:opentest4j:jar:1.3.0:test
[INFO]    |  |  +- org.junit.platform:junit-platform-commons:jar:1.12.2:test
[INFO]    |  |  \- org.apiguardian:apiguardian-api:jar:1.1.2:test
[INFO]    |  +- org.junit.jupiter:junit-jupiter-params:jar:5.12.2:test
[INFO]    |  \- org.junit.jupiter:junit-jupiter-engine:jar:5.12.2:test
[INFO]    |     \- org.junit.platform:junit-platform-engine:jar:1.12.2:test
[INFO]    +- org.mockito:mockito-core:jar:5.17.0:test
[INFO]    |  +- net.bytebuddy:byte-buddy-agent:jar:1.17.8:test
[INFO]    |  \- org.objenesis:objenesis:jar:3.3:test
[INFO]    +- org.mockito:mockito-junit-jupiter:jar:5.17.0:test
[INFO]    +- org.skyscreamer:jsonassert:jar:1.5.3:test
[INFO]    |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
[INFO]    +- org.springframework:spring-core:jar:6.2.19:provided
[INFO]    |  \- org.springframework:spring-jcl:jar:6.2.19:provided
[INFO]    +- org.springframework:spring-test:jar:6.2.19:test
[INFO]    \- org.xmlunit:xmlunit-core:jar:2.10.4:test
Code Examples

https://github.tools.sap/sb-bnb/usage-record-management-client/pull/660

Stack Trace
java.lang.IllegalAccessException: class com.sap.cloud.sdk.datamodel.odatav4.adapter.GsonVdmEntityAdapter cannot access a member of class com.sap.ngom.urm.client.vdm.namespaces.usagerecords2s.UsageRecordAggregationRequest with modifiers "private"
	at java.base/jdk.internal.reflect.Reflection.newIllegalAccessException(Unknown Source)
	at java.base/java.lang.reflect.AccessibleObject.checkAccess(Unknown Source)
	at java.base/java.lang.reflect.Field.checkAccess(Unknown Source)
	at java.base/java.lang.reflect.Field.get(Unknown Source)
	at com.sap.cloud.sdk.datamodel.odatav4.adapter.GsonVdmEntityAdapter.getEntityAsJsonObject(GsonVdmEntityAdapter.java:309)
	at com.sap.cloud.sdk.datamodel.odatav4.adapter.GsonVdmEntityAdapter.write(GsonVdmEntityAdapter.java:277)
	at com.sap.cloud.sdk.datamodel.odatav4.adapter.GsonVdmEntityAdapter.write(GsonVdmEntityAdapter.java:41)
	at com.google.gson.TypeAdapter$NullSafeTypeAdapter.write(TypeAdapter.java:304)
	at com.google.gson.internal.bind.TypeAdapterRuntimeTypeWrapper.write(TypeAdapterRuntimeTypeWrapper.java:73)
	at com.google.gson.internal.bind.CollectionTypeAdapterFactory$Adapter.write(CollectionTypeAdapterFactory.java:100)
	at com.google.gson.internal.bind.CollectionTypeAdapterFactory$Adapter.write(CollectionTypeAdapterFactory.java:64)
	at com.google.gson.Gson.toJson(Gson.java:943)
	at com.google.gson.Gson.toJsonTree(Gson.java:801)
	at com.google.gson.Gson.toJsonTree(Gson.java:778)
	at com.sap.cloud.sdk.datamodel.odatav4.core.ActionRequestBuilder.serialize(ActionRequestBuilder.java:116)
	at com.sap.cloud.sdk.datamodel.odatav4.core.ActionRequestBuilder.lambda$serializeParameters$0(ActionRequestBuilder.java:146)
	at java.base/java.util.HashMap.forEach(Unknown Source)
	at com.sap.cloud.sdk.datamodel.odatav4.core.ActionRequestBuilder.serializeParameters(ActionRequestBuilder.java:146)
	at com.sap.cloud.sdk.datamodel.odatav4.core.ActionRequestBuilder.toRequest(ActionRequestBuilder.java:138)
	at com.sap.cloud.sdk.datamodel.odatav4.core.CollectionValueActionRequestBuilder.execute(CollectionValueActionRequestBuilder.java:101)
	at com.sap.cloud.sdk.datamodel.odatav4.core.CollectionValueActionRequestBuilder.execute(CollectionValueActionRequestBuilder.java:25)
	at com.sap.ngom.urm.client.service.impl.UsageRecordClientImpl.runUsageRecordAggregation(UsageRecordClientImpl.java:76)
Log File
Log file ...
Affected Development Phase

Production

Impact

Impaired

Timeline

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Open GsonVdmEntityAdapter and inspect getEntityAsJsonObject around line 309, focusing on the shared entityProperties Field access and accessibility restoration described in the report. Reproduce the provided concurrent serialization test with UsageRecordAggregationRequest and verify that concurrent runs produce no IllegalAccessException logs.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.