Concurrency Bug in Java 4.27+ Static Initialization leads to NPE

[googleberg]

What version of protobuf and what language are you using?
Version: 4.27+
Language: Java

What operating system (Linux, Windows, ...) and version?
Any OS

What did you do?
Initialized Generated Protobuf Messages in parallel.

Steps to reproduce the behavior:
https://github.com/nordnet/protobuf-issue/

What did you expect to see
No Error.

What did you see instead?
NPE + Stacktrace like the following:

java.lang.ExceptionInInitializerError
at com.google.devtools.cloudtrace.v2.Span.getDescriptor(Span.java:62)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.lang.NullPointerException: Cannot invoke "com.google.protobuf.DescriptorProtos$FeatureSet.getExtension(com.google.protobuf.ExtensionLite)" because the return value of "com.google.protobuf.Descriptors$FieldDescriptor.getFeatures()" is null
at com.google.protobuf.Descriptors$FieldDescriptor.legacyEnumFieldTreatedAsClosed(Descriptors.java:1582)
at com.google.protobuf.MessageReflection.mergeFieldFrom(MessageReflection.java:1219)
at com.google.protobuf.GeneratedMessage$ExtendableBuilder.parseUnknownField(GeneratedMessage.java:1630)
at com.google.protobuf.DescriptorProtos$FieldOptions$Builder.mergeFrom(DescriptorProtos.java:29650)
at com.google.protobuf.DescriptorProtos$FieldOptions$Builder.mergeFrom(DescriptorProtos.java:29179)
at com.google.protobuf.CodedInputStream$ArrayDecoder.readMessage(CodedInputStream.java:853)
at com.google.protobuf.DescriptorProtos$FieldDescriptorProto$Builder.mergeFrom(DescriptorProtos.java:13676)
at com.google.protobuf.DescriptorProtos$FieldDescriptorProto$1.parsePartialFrom(DescriptorProtos.java:14461)
at com.google.protobuf.DescriptorProtos$FieldDescriptorProto$1.parsePartialFrom(DescriptorProtos.java:14453)
at com.google.protobuf.CodedInputStream$ArrayDecoder.readMessage(CodedInputStream.java:869)
at com.google.protobuf.DescriptorProtos$DescriptorProto$Builder.mergeFrom(DescriptorProtos.java:7393)
at com.google.protobuf.DescriptorProtos$DescriptorProto$1.parsePartialFrom(DescriptorProtos.java:9525)
at com.google.protobuf.DescriptorProtos$DescriptorProto$1.parsePartialFrom(DescriptorProtos.java:9517)
at com.google.protobuf.CodedInputStream$ArrayDecoder.readMessage(CodedInputStream.java:869)
at com.google.protobuf.DescriptorProtos$FileDescriptorProto$Builder.mergeFrom(DescriptorProtos.java:2603)
at com.google.protobuf.DescriptorProtos$FileDescriptorProto$1.parsePartialFrom(DescriptorProtos.java:4517)
at com.google.protobuf.DescriptorProtos$FileDescriptorProto$1.parsePartialFrom(DescriptorProtos.java:4509)
at com.google.protobuf.AbstractParser.parsePartialFrom(AbstractParser.java:77)
at com.google.protobuf.AbstractParser.parseFrom(AbstractParser.java:97)
at com.google.protobuf.DescriptorProtos$FileDescriptorProto$1.parseFrom(DescriptorProtos.java:4509)
at com.google.protobuf.DescriptorProtos$FileDescriptorProto.parseFrom(DescriptorProtos.java:2077)
at com.google.protobuf.Descriptors$FileDescriptor.internalUpdateFileDescriptor(Descriptors.java:505)
at com.google.devtools.cloudtrace.v2.TraceProto.(TraceProto.java:353)
... 8 more

[zhangskz]

This should only impact OSS users using old generated code (<26.x) with new runtime (>= 28.x) which uses lazy feature resolution and triggers a race in double-check locking.

We should be able to patch this shortly, likely later this week.

[kberezin-nshl]

@zhangskz @googleberg in the meantime, could you propose a workaround?
Many Google libraries, like Spanner, including the latest release, apparently still use old generated protobuf code.

This has pretty severe impact in Dataflow, for example, where hundreds of VMs start at the same time and likelihood of the issue is pretty high.