Factory Bean, BeanDefinitionRegistryPostProcessor and XML config causes properties to not be available

Affects: 5.3.29, 6.1.12, probably others. I've not done an exhaustive search.

We've hit a problem with using factory beans that are constructed from XML configuration and have properties injected into them, when there is a BeanDefinitionRegistryPostProcessor calling BeanFactoryUtils.beanNamesForTypeIncludingAncestors in the postProcessBeanDefinitionRegistry method.

This sounds very specific - and it is - but this has come about because the OAuth2ClientConfiguration class from spring-security-config does exactly this. (Note that this didn't happen with this OAuth2ClientConfiguration class in Spring 5 but does in Spring 6. However, the bug as a whole reproduces in Spring 5 when I do it myself)

From what we can tell, when this setup exists the factory bean is instantiated before the properties are loaded, and therefore the wrong value is provided.

Things we've also noticed:

• This only happens when the factory bean is constructed from XML config. If it's component scanned, or constructed from Java config then it works correctly. This includes if the Java config is itself loaded because it was referenced in XML config.
• This reproduces whether the factory bean extends AbstractFactoryBean or implements FactoryBean.
• I've managed to reproduce it in a Spring Boot app from https://start.spring.io, but we first noticed it in a Spring MVC app.

I've attached a Minimal reproducible example to show this happening.
properties.zip

Cheers

Begin with the attached properties.zip minimal reproducible example, then trace BeanFactoryUtils.beanNamesForTypeIncludingAncestors from BeanDefinitionRegistryPostProcessor.postProcessBeanDefinitionRegistry. Compare XML-created FactoryBean instances with component-scanned and Java-configured instances. Done means a regression test demonstrates that injected properties are available before the factory bean is used.