`DTD.getElement(String)` is not thread safe. If there are 2 parallel parser 
threads which call with the same new name then in the Vector there can be 2 
identical elements. These unsynchronized elementHash.get(name) calls can both 
observe null before either thread creates and puts the `Element` which will 
then have duplicates. The index from elements.size() can also be wrong under 
races.

The block needs to be synchronized to prevent this

---------
- [x] I confirm that I make this contribution in accordance with the [OpenJDK 
Interim AI Policy](https://openjdk.org/legal/ai).

-------------

Commit messages:
 - 8382491: Calling javax.swing.text.html.parser.DTD.getElement(String) with 
new name is not thread safe

Changes: https://git.openjdk.org/jdk/pull/31568/files
  Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=31568&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8382491
  Stats: 142 lines in 2 files changed: 136 ins; 1 del; 5 mod
  Patch: https://git.openjdk.org/jdk/pull/31568.diff
  Fetch: git fetch https://git.openjdk.org/jdk.git pull/31568/head:pull/31568

PR: https://git.openjdk.org/jdk/pull/31568

Reply via email to